How Do You Secure a Site?
How do you secure a site: HTTPS, CSP, cookies?
Answer out loud in under a minute: a definition, one concrete example, and one pitfall or trade-off.
Hints
Hint 1
Name the attack each measure stops: HTTPS stops eavesdropping, CSP limits XSS, and SameSite with CSRF tokens stops cross-site request forgery.
Solution
Show the approach
Answer
HTTPS everywhere, with HSTS. A Content Security Policy that allows scripts only from named sources or nonces limits XSS. Session cookies get Secure, HttpOnly and SameSite, plus CSRF tokens on state-changing requests. Escape output by default (React does for text), and never pass user input to innerHTML.