Browsers enforce a powerful default protection called the Same-Origin Policy, which prevents scripts loaded from one origin from reading resources served by a different origin. Two URLs share an origin only when they match in protocol, host, and port, so https://example.com:443 and http://example.com:80 are technically distinct origins. This default isolation is essential because it stops a malicious page from quietly reading a user's data on another site, but it is also rigid, so Cross-Origin Resource Sharing (CORS) exists as a controlled escape hatch. CORS lets servers declare, via response headers, which origins may access their resources, which HTTP methods are permitted, which custom headers are allowed, and whether credentials (such as cookies) may be included. Browsers send a preflight OPTIONS request to verify permissions before sending the actual request, so a misconfigured CORS policy can quietly turn into a significant authorization bypass.
Content Security Policy (CSP) is another defense layer, configured via an HTTP response header that tells the browser which sources of content are allowed to load. By setting directives such as default-src 'self', script-src 'self' cdn.example.com, and style-src 'self' 'unsafe-inline', a site can block inline scripts, restrict script origins, and dramatically shrink the attack surface available to an XSS payload. CSP nonces go further: a server generates a unique random token for each page load, declares it in the policy with script-src 'nonce-abc123', and tags only those specific inline scripts with the matching nonce attribute. Because the nonce changes on every request, an attacker who injects a script cannot know the right value, and the browser refuses to execute anything that lacks it. CSP also helps defend against clickjacking through the frame-ancestors directive, which replaces the older X-Frame-Options header.
A complete browser-hardening strategy relies on a family of HTTP security headers working together. Strict-Transport-Security (HSTS) instructs the browser to use HTTPS for a domain for a specified period, even if the user types http://, which prevents SSL stripping attacks; the preload flag adds the domain to a list hardcoded into major browsers. X-Content-Type-Options: nosniff blocks MIME sniffing, denying browsers the freedom to reinterpret responses as a different content type. The legacy X-XSS-Protection header turns on older browser XSS filters, while Referrer-Policy controls how much URL information travels in the Referer header to other sites. Permissions-Policy (formerly Feature-Policy) restricts which powerful browser features such as camera, microphone, or geolocation a page may use. Finally, the SameSite cookie attribute has become one of the simplest yet most powerful CSRF mitigations: Strict sends the cookie only for same-site requests, Lax (the default in modern browsers) sends it for top-level navigations but not embedded requests, and None always sends it but requires the Secure flag. Together, these headers create layered, defense-in-depth protection at the browser boundary.