Javascript can manipulate the DOM DOM - Document Object Model - is a cross platform model for rrepresenting and interacting with objects in html is
a tree of nodes each node has a tag attributes and child nodes
risk #1 web servers should be protected from unauthorized access Example: an attacker should not be able to hack into google.com and provide malicious search results to users protection: server side security example: protect the server computer from buffer overflow attacks
risk #2: a malicious website shuld not be able to damage our computer protection: sandboxing javascript is not allowed to access files on our computer privlege separation, least privilege browsers are carefully written to avoid exploiting the browse’s code ( e.g. write the browser in a memory safe language ) z
risk #3 a mlicious website should not be able to tamper with our information or interactions on other website protection: same origin policy
same origin policy: a rule that prevents one website from tampering with other unrelated websites under the policy a web browser permits scripts contained in a first web page to access data in a second web page but only if both web pages have the same origin enforced by the web browser prevents a malicious website from tampering with behavior on other websites every webpage has an origin defined by it’s url with 3 parts protocol domain port htps://www.test.com:443/assets/lock.png
two websites with different origins cannot interact with eachother if test.com reaches out to google.com thats cooked javascript runs from the origin of the page that loads it if test.com fetches javascript from google.com, tha tjavascript has the origin of test.com
if test.como has copy pasted javascript onto it’s webpage, that’s an issue
same origin policy is just for javascript
websites cna fetch and display images from other origins websites can agree to allow some limited sharing CORS and postMessage
server creates a cookie by including a set-cookie header in it’s response
data in a cookie is stored as name-value pair the name and value can be any string.
if secure attribute is true then the browser only sends the cookie if the request is made over https ( not http )
if the HttpOnly attribute is true then javascript in th ebrowser is not allowed to access the cookie
domains can be sorted into hierarchy . .edu charlotte.edu cci.charlotte.edu
sending cookies concatenate the cookie domain and path line it up below the requested url at the first single / domain and path must match the url for a cookie to match
session authentication
session: a sequence of requests and responses associated with the same authenticated user when the session is over ( you log out, or it expires ) future requests are not associated with you
session token: a secret value used to associate requests with an authenticated user the first time you visit the site you give username and password if they are valid you receive a session token the server associates you with the session token
when you make future requests the browser attaches the session token cookie in your request the server checks the session token to figure out if it is valid you are logged in when you log out token is deleted
if an attacker steals your session token, they can login as you
servers need to generate session tokens randomly and securely.
browsers need to make sure malicious websites cannot steal session tokens. enforce isolation with cookie policy and same origin policy.