Web Security 101 — how attackers borrow your identity, and how to stop them

I kept seeing the same advice. "Sanitize your inputs." "Set HttpOnly." "Add a CSRF token." I knew these mattered. I even knew how to apply them. But I couldn't have told you what I was actually defend