162 cards
Web security is the practice of protecting web applications, the users who interact with them, and the data they handle from malicious access, misuse, and disruption. Security failures do more than cause outages — they erode user trust, expose sensitive data, and can create legal liability, financial loss, and long-ter...
Despite decades of awareness, the same families of flaws keep appearing in web applications. Injection attacks lead the list. SQL injection happens when untrusted input is concatenated into a query, allowing attackers to alter its structure. Variants include UNION-based attacks that append rows from arbitrary tables, b...
Most web vulnerabilities can be prevented at the point where untrusted data meets code. Input validation is the first line: incoming data should be checked for expected type, format, length, and constraints before it is processed further. Client-side validation still has a place because it improves user experience, but...
Authentication verifies identity, and session management maintains that authenticated state across subsequent requests, usually by issuing a session ID cookie. The two must not be confused: a strong login cannot save an application whose session IDs are guessable, reused, or never rotated. Session token entropy should...
The browser is a willing ally when given the right instructions. Security headers are HTTP response headers that add browser-side protections with little implementation effort. Content-Security-Policy restricts which scripts, styles, and resources may load — and crucially which can be embedded as frames via frame-ances...
Several community references anchor day-to-day security work. The OWASP Top 10 is a regularly updated list of the ten most critical web application security risks, published by the Open Worldwide Application Security Project. Common Weakness Enumeration (CWE) is a community-developed catalog of software and hardware we...