JavaScript & Browser DOM
JavaScript
• A server is a computer (typically a powerful one) that resides in a data
center (sometimes called the cloud), and is responsible for handling
requests to a website.
• Sometimes these servers will actually be a cluster of many servers;
other times it might just be a single lightweight server used for
development or logging.
• A client, on the other hand, is any device a user has access to that they
manipulate to use a web application.
• A client could be a mobile phone, a mall kiosk, or a touch screen in an
electric car—but for our purposes it will usually just be a web browser.
JavaScript
• Web servers today run on Python, Java, JavaScript, C++, etc. Clients
(in particular, the browser) do not have that luxury. JavaScript is not
only a programming language, but also the sole programming
language for client-side scripting in web browsers.
• JavaScript is a dynamic programming language that was originally
designed for use in internet browsers. JavaScript is now used in many
applications, from mobile to the internet of things, or IoT.
• When possible, the backend code examples are written using a
JavaScript syntax as well so that no time is wasted in context switching.
JavaScript is now used in many applications, from mobile to IoT.
JavaScript
• JavaScript is a unique language as development is tied to the growth
of the browser, and its partner, the Document Object Model (DOM).
Because of this, there are some quirks you might want to be aware of
before moving forward.
Variables and Scope
Functions
• In JavaScript, functions are objects. That means they can be assigned
and reassigned using the variables and identifiers
The first function is an anonymous function—that means it
can’t be referenced after it is created. The next four are
simply functions with scope specified based on the
identifier provided. The sixth function is a shorthand
function—it shares context with its parent. The final
function is a special type of function you will probably only
find in Java‐Script, known as an IIFE—immediately
invoked function expression. This is a function that fires
immediately when loaded and runs inside of its own
namespace. These are used by more advanced
JavaScript developers to encapsulate blocks of code from
being accessible elsewhere.
For more details: Refer Text Book
Browser DOM
• Have sufficient understanding of asynchronous programming—the
model that is dominant on the web and in client/server applications.
With that information in your head, the final JavaScript-related
concept you should be aware of is the browser DOM.
• The DOM is the hierarchical representation data used to manage state
in modern web browsers.
• It shows the window object,
one of the topmost standard
objects defined by the DOM
specification.
• JavaScript is a programming language, and like any good programming
language it relies on a powerful, standard library. This library, unlike
standard libraries in other languages, is known as the DOM.
• The DOM provides routine functionality that is well tested and performant,
and is implemented across all major browsers, so your code should function
identically or nearly identically regardless of the browser it is run on.
• Unlike other standard libraries, the DOM exists not to plug functionality
holes in the language or provide common functionality (that is a secondary
function of the DOM) but mainly to provide a common interface from
which to define a hierarchical tree of nodes that represents a web page.
• You have probably accidentally called a DOM function and assumed it
was a JS function.
• An example of this is [Link]() or
[Link].
• The main objects that make up the DOM are window and document, each
carefully defined in a specification maintained by an organization called
WhatWG.
• Regardless of if you are a JavaScript developer, web application pen
tester, or security engineer, developing a deep understanding of the
browser DOM and its role in a web application is crucial to spotting
vulnerabilities that become evident at the presentation layer in an
application.
• Consider the DOM to be the framework from which JavaScript-based
applications are deployed to end users, and keep in mind that not all
script-related security holes will be the result of improper JavaScript, but
can sometimes result from improper browser DOM implementation.
