> The modern web stack is a security house of cards, as demonstrated.
Perhaps, but I feel like major recent changes are fixing most of these vulnerabilities:
1. Content Security Policy locks down most of the vulnerabilities that result from something on a page being able to contact something from a different origin. Of course, it's not set by default and these days requires a lot of trial and error to figure out the "right" way to set it, but it solves a lot of issues.
2. On the cookie front, the recent changes to the default SameSite behavior also pretty much end CSRF bugs.
Perhaps, but I feel like major recent changes are fixing most of these vulnerabilities:
1. Content Security Policy locks down most of the vulnerabilities that result from something on a page being able to contact something from a different origin. Of course, it's not set by default and these days requires a lot of trial and error to figure out the "right" way to set it, but it solves a lot of issues.
2. On the cookie front, the recent changes to the default SameSite behavior also pretty much end CSRF bugs.