it is a note about security and vulnerability on web development. includes topic of Cross Document Messaging, CORS , HTML5 Sinks. HTML Injection, XSS, SQL Injection, Brute Force Password

1. Web Security
2019/05/14

2. Ageda
- 1) Cross Document Messaging
- 2) CORS
- Websockets
- 3) HTML5 Sinks

3. Practice
- HTML Injection
- XSS
- SQL Injection
- Brute Force Password

4. 1) iFrame

5. iFrame
Parent Website
Source: https://html.spec.whatwg.org/multipage/web-messaging.html#web-messaging

6. 1) iFrame

7. 2) CORS

8. Allow-Origin

9. Access-Control-Allow-Origin: *
echo back the Origin header
Allow only selected, trusted domains
Origin header may be spoofed outside the browser

13. 3) HTML5 Sinks

18. 3) Local Storage

22. WARNING
Please do not attempt to hack any computer system without legal permission to do
so.

23. Reference
- Html security
- React