Tricking a logged-in user's browser into sending an unwanted request to a site where the user is authenticated Guessing passwords Stealing a database through SQL Injecting scripts into pages
Encrypted with AES, so they can be decrypted later In plain text in a secure database As salted hashes using a slow algorithm such as bcrypt, scrypt, or Argon2 As MD5 hashes
Yes, but only for POST requests No; CORS only controls which web origins a browser lets read the responses. Server-side authentication is still required CORS encrypts API traffic Yes, it blocks all unauthorized clients
Session data is stored on the server; the client usually keeps only a session ID in a cookie Sessions do not use cookies at all Sessions are stored in DNS All session data is stored in the cookie
