An interactive concept flow for treat browser input as data at every boundary, from its assumptions through the main operation and boundary checks.
trace / request.md
readyBrowser security depends on keeping untrusted data from becoming executable code or changing the meaning of a command. Validation checks whether data fits an expected shape; context-aware output encoding ensures text is interpreted as text in HTML, an attribute, a URL, or JavaScript.
Use the stages in order to explain treat browser input as data at every boundary. Each stage makes one assumption visible: what the operation promises, what representation it uses, how state changes, which boundary can invalidate a shortcut, and what evidence confirms the result.
For a worked explanation, continue to the topic article and execution trace.
Not started
Sign in to save your learning progress.