HTTP does not remember users by itself, so sites use cookies or tokens to recognize that the same browser is logged in. A session cookie is like a temporary badge, not a place to store a password.

• HttpOnly keeps page JavaScript from reading a cookie.
• Secure means the cookie is sent only over HTTPS.
• SameSite limits when cookies are sent with cross-site requests.

A browser origin is protocol + domain + port. The same-origin policy usually stops JavaScript from one origin from reading private data from another origin.

• CORS is a server's controlled permission for selected cross-origin reads.
• CORS is not login, authorization, or a firewall.
• Some cross-site requests can still be sent, so servers still need CSRF defenses.

A REST API is a structured way for apps and servers to work with resources over HTTP. The method and status code should tell a clear story.

• GET reads; POST creates or performs an action; PUT/PATCH update; DELETE removes.
• Every request must be checked: who is calling, what they may do, and whether the input is valid.
• HTTPS protects API credentials while they travel over the network.

Cross-site scripting happens when attacker-controlled content runs as JavaScript inside a trusted page. Then the page can act with the user's access.

• Treat user input as data, not HTML or code.
• Use safe output encoding, safe DOM APIs, and sanitizing for any allowed HTML.
• Content Security Policy can reduce damage, but it does not replace fixing the bug.

Cross-site request forgery abuses the fact that browsers may attach login cookies automatically. A malicious page tries to make the victim's browser send a real request.

• Use anti-CSRF tokens for state-changing actions.
• Set SameSite cookies where possible.
• Re-check intent for sensitive actions like password, email, or payment changes.

SQL injection happens when untrusted input is joined into a database command. The database may read it as instructions instead of plain text.

• Use parameterized queries or prepared statements.
• Do not build SQL by joining strings with user input.
• Least-privilege database accounts limit damage if a bug slips through.

Security headers are instructions a server sends so the browser can enforce safer behavior. They are guardrails, not a replacement for server-side checks.

• HSTS tells browsers to use HTTPS for that site.
• CSP limits where scripts and other content may load from.
• Frame, referrer, and permissions policies reduce common browser-side risks.

Content-Type tells the browser how to interpret a response, and file uploads bring untrusted bytes into the system. Names and extensions can lie.

• Validate type, size, and content on the server.
• Store uploads outside executable web paths when possible.
• Return files with safe content types and download headers when needed.

Insecure Direct Object Reference: a page shows object number 1041, you change the address to 1042 and see someone else’s data. The server trusted the ID instead of checking who is asking.

• Authorization must be checked on every object access, not just at login.
• Random, unguessable IDs help, but they are not authorization.
• If you stumble on this in a real site, stop and report it — don’t keep browsing others’ data.