21. Web Security Basics (Defending the HTML)

1. Cross-Site Scripting (XSS) Inject Vectors

Basic: Ek user jab dusre user par malicious JavaScript attack karta hai.

Pro: Jab form data database se utha kar HTML DOM mein paint kiya jata hai. Agar kisine Comment Box mein <script>alert(document.cookie)</script> bheja tha, aur Backend ne without filter pass kar diya, toh parser comment ko code block samjhega aur user ke login cookies hacker ke remote server par bhej dega (Stored XSS).
Defense: HTML Entities Encode hamesha lazmi hai. < ko < mein transform karein, jisse browser use sirf visual character samjhega, execution tag nahi.

2. Content Security Policy (CSP) Protocol

Pro: XSS rokhne ka ultimate terminator CSP hai. Ye ek HTTP header ya Meta tag (<meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self' cdn.com">) hota hai. Browser parser strictly rule banata hai: "Agar Script, Image ya iframe mere domain (self) se ya cdn.com se load nahi ho raha, toh use turant kill kardo". Isse inline JS injection fail ho jate hain.

3. Cross-Site Request Forgery (CSRF)

Pro: Agar aap bank app mein login hain. Attacker aapko phising link deta hai jisme ek hidden auto-submit form pada hai POST request leke "Transfer Fund to Attacker". Kyunki aap login hain, aapke browser ki cookie automatically authorization proof form request mein chipka kar bhej degi aur server manega request legitimate thi.
Defense: HTML form tag ke andar hamesha ek crypto random hidden element <input type="hidden" name="csrf_token" value="xyz..."> Server se bind hota hai, jiske bina submit accept hi nahi hota.

4. Secure Form Transmissions & HTTPS

Pro: HTML data clear text strings mein internet wires pe flow karta hai. Agar HTTP network par koi form submitted hai, attacker WiFi Router par packet sniffing Tool (Wireshark) laga kar password clear string par padh lega (Man In The Middle Attack). Isliye secure Transport Layer Security (TLS/HTTPS) routing implement karna core hygiene hai.