iwantcoding
.com
Tutorials
▾
Web Frontend
HTML
CSS
HTML5
CSS3
JavaScript
TypeScript
Sass
React
Vue
Svelte
Tailwind
Backend
Python
PHP
Node.js
Java
Go
Rust
Ruby
C#
Databases
SQL
MySQL
PostgreSQL
MongoDB
Firebase
GraphQL
Redis
Mobile
React Native
Flutter
Swift
Kotlin
Ionic
Cloud & DevOps
AWS
Docker
Kubernetes
CI/CD
Linux/Bash
AI & Data
NumPy/Pandas
Machine Learning
TensorFlow
PyTorch
LangChain
RAG
Cybersecurity
XSS
SQL Injection
CSRF
OWASP Top 10
Cryptography
Ethical Hacking
Tools
Git
DSA
Design Patterns
RegEx
VS Code
Specialty
Game Dev
WordPress
Web3/Solidity
Three.js
Capstone
Enterprise Architecture
HTML
CSS
JAVASCRIPT
SQL
PYTHON
PHP
TYPESCRIPT
REACT
NODEJS
MONGODB
DOCKER
GIT
TAILWIND
GRAPHQL
LINUX-BASH
AWS
KUBERNETES
VUE
SVELTE
SASS
THREEJS
GO
RUST
JAVA
RUBY
CSHARP
WORDPRESS
POSTGRESQL
MYSQL
REDIS
FIREBASE
REACT-NATIVE
FLUTTER
SWIFT
KOTLIN
IONIC
CICD
NUMPY-PANDAS
ML
TENSORFLOW
PYTORCH
LANGCHAIN
XSS
SQLI
CSRF
OWASP
CRYPTO
DSA
DESIGN-PATTERNS
REGEX
VSCODE
GAMEDEV
WEB3
ENTERPRISE
CAPSTONE
ETHICAL-HACKING
🔥 Daily
👥 Rooms
🏆 Top
Log in
Sign up
AI ✨
XSS Tutorial
BOSS QUIZ
10 questions · 5 minutes · pass at 70% to clear the track.
05:00
Start
Q1.
CSP is delivered via…
from Content Security Policy
A cookie
A response header (or meta tag)
The URL
TLS
Q2.
A modern CSP typically uses…
from Content Security Policy
unsafe-inline only
Nonces or hashes for inline scripts
A single * directive
No script-src
Q3.
Secure means…
from HttpOnly / SameSite Cookies
Encrypted at rest
Only sent over HTTPS
Tied to a user
Signed by JWT
Q4.
In Vue, raw HTML uses…
from Auto-escaping Frameworks
v-html
v-raw
v-text
v-bind
Q5.
The three classic shapes are…
from Intro
Reflected, stored, DOM-based
GET, POST, PUT
A, AAAA, CNAME
TCP, UDP, ICMP
Q6.
It should be used when…
from DOMPurify
You always trust input
You must allow rich-text HTML from users
For all string concatenation
For URL building
Q7.
CSP can be tested without blocking via…
from Content Security Policy
Content-Security-Policy-Report-Only
CSP-Test header
X-CSP-Debug
Setting it to debug=1
Q8.
In Blade, RAW echo is written as…
from Auto-escaping Frameworks
{{ \$v }}
{!! \$v !!}
{% \$v %}
<%= \$v %>
Q9.
In React, raw HTML injection is opted into via…
from Auto-escaping Frameworks
<rawHTML>
dangerouslySetInnerHTML
innerHTML
@html
Q10.
HttpOnly stops…
from HttpOnly / SameSite Cookies
CSRF
JS from reading the cookie
TLS errors
SameSite bypass
Submit
Back to XSS Tutorial
🏆
Achievement unlocked!