The web and browser security model: HTTP, origin, cookies, CORS and CSP
You read a web request line by line and see in your own lab app how the browser keeps origins apart and what cookies, CORS and CSP protect.
Level 101 · 20 lessons · 17 practice labs
Lessons
Reading HTTP
- Client, server and the path between: how a page arrives
- Parts of a URL: scheme, host, path, query and fragment
- Anatomy of an HTTP request: request line, headers and body
- What HTTP methods and status codes say about security
- Short task: break down five requests in the browser’s developer tools
State, data and trust
- HTTP is stateless: why cookies and sessions exist
- Headers that matter for security: Host, Referer, Origin and User-Agent
- Form submissions and body formats: urlencoded, multipart and JSON
- Encodings: URL, HTML entities, Base64 and Unicode
- Trust boundaries: everything from the user is input
- Short task: reproduce a login form’s request with curl
Origin and cookies
- What an origin is: scheme, host and port
- The same-origin policy: what it blocks and what it does not
- Site versus origin: why subdomains matter
- Anatomy and flags of a cookie: Domain, Path, Secure, HttpOnly and SameSite
- localStorage, sessionStorage and IndexedDB: who can read them
- Short task: decide whether ten URL pairs share an origin and show where the cookies go
Controlled sharing
- CORS and preflight requests: one origin granting access to another
- Introduction to Content Security Policy (CSP): which scripts may run
- Capstone: review and report on the lab app’s browser security settings
Practice labs
- Find where the password goes in this login request: Read the lab app's login request line by line, show whether the password travels in the body or the query string and fix the form if it is in the query.
- What the status codes say: interpret five responses: Interpret the status codes and headers of five responses from the lab app, find the error page returned with the wrong code and change it to the right one.
- Body formats: send the same form in three encodings: Reproduce a profile form with curl as urlencoded, multipart and JSON, find why the server accepts the unexpected format and add a content-type check.
- Peel the encoding layers: a nested-encoded parameter: Decode a parameter wrapped in URL, Base64 and HTML-entity encoding, find at which layer the server validates it and move validation after the final decode.
- Same origin or not: classify ten URL pairs: Classify ten URL pairs in the lab by scheme, host and port and prove which pairs can read each other's data.
- A session cookie with missing flags: Find the missing Secure, HttpOnly and SameSite flags on the lab app's session cookie, fix them in the server settings and show the new cookie in the browser.
- A cookie leaking to a subdomain: Prove which subdomains receive a cookie whose Domain attribute is too broad, narrow its scope and move it to the __Host- prefix.
- Who can read the token in localStorage: Show that scripts on the same origin can reach a token kept in localStorage and make the change that moves it to an HttpOnly cookie.
- A CORS response that allows every origin: Find the lab API response that allows every origin, narrow the allow list to its own front-end origin and show that a request from the second origin is refused.
- Why the preflight request fails: The legitimate front end's PUT request fails at preflight; find the missing allowed method and header and fix it with the narrowest CORS setting.
- An API that reflects the origin and allows credentials: Prove from the second lab origin that the configuration reflects the Origin header and allows credentials, then close it with a fixed allow list.
- A CORS setting that trusts the null origin: Show with a sandboxed frame page why an endpoint that allows the null origin is dangerous, fix the setting and log the refused requests.
- Read the CSP header: which scripts may run: Read the lab page's CSP header, predict which of five script sources will run and confirm with the browser console.
- A first policy for a page with no CSP: Write a policy that allows only the page's own origin for a help page that has no CSP and show the page still works.
- Collect CSP violations in report-only mode: Deploy a policy in report-only mode, separate legitimate sources from the incoming violation reports and update the policy accordingly.
- Drop unsafe-inline and keep the page working: Remove unsafe-inline from the policy, move inline scripts to an external file and show every feature of the page still works.
- Browser security settings review: three pages: Compare cookie, CORS and CSP settings on three pages of the lab app, fix the weakest page and produce before-and-after evidence.
About this course
You read a web request line by line and see in your own lab app how the browser keeps origins apart and what cookies, CORS and CSP protect.
What you will learn
- Reading HTTP
- State, data and trust
- Origin and cookies
- Controlled sharing
Prerequisites
No prior knowledge is needed; the course starts from zero.
Lab environment
Lessons run on your own Kali Linux desktop in the browser, with the tools ready in their windowed interfaces. Nothing to install; a computer screen is recommended.
Frequently asked questions
- Is this course right for my level?
- The course is at beginner level; every term is explained where it first appears.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.