Web Security on Software Engineering Learning Paths

Web Security Fundamentals

Mon, 01 Jan 0001 00:00:00 +0000

Why Web Security Matters#

Every web application exposed to the internet is under constant attack. Automated scanners probe for vulnerabilities within minutes of a new service going live. A single SQL injection or misconfigured header can expose millions of user records, destroy a company’s reputation, and trigger regulatory fines measured in percentages of global revenue.

Security is not a feature — it is a property of the system. You cannot bolt it on at the end. This section establishes the foundational mental models that underpin every subsequent topic.

Injection Attacks

Mon, 01 Jan 0001 00:00:00 +0000

What Is Injection?#

Injection occurs when untrusted data is sent to an interpreter as part of a command or query. The interpreter cannot distinguish between intended instructions and injected instructions. This has been the most devastating class of web vulnerability for over two decades.

The root cause is always the same: string concatenation of user input into a structured language (SQL, shell, LDAP, NoSQL query).

SQL Injection#

How It Works#

The application builds a SQL query by concatenating user input directly:

Cross-Site Scripting (XSS)

Mon, 01 Jan 0001 00:00:00 +0000

What Is XSS?#

Cross-Site Scripting (XSS) occurs when an attacker injects malicious scripts into web pages viewed by other users. The victim’s browser cannot distinguish between legitimate scripts from the application and injected scripts — it executes both with the same origin and permissions.

XSS is the most prevalent web vulnerability. It enables session hijacking, credential theft, defacement, phishing, and client-side malware distribution.

Types of XSS#

Reflected XSS#

The malicious script is part of the HTTP request and reflected back in the response without being stored. The attacker crafts a URL containing the payload and tricks the victim into clicking it.

Authentication

Mon, 01 Jan 0001 00:00:00 +0000

What Is Authentication?#

Authentication answers one question: who are you? It is the process of verifying that a claimed identity is genuine. Authentication is distinct from authorisation (what you can do), but a failure in authentication makes authorisation meaningless.

Password Storage#

The Golden Rule#

Never store passwords in plaintext. Never store them encrypted (encryption is reversible). Always store a one-way hash with a unique salt per password.

How Password Hashing Works#

User password: "correct horse battery staple"
 │
 ▼
┌───────────────────┐
│ Hashing function │ ← bcrypt, argon2, scrypt
│ + unique salt │
│ + cost factor │
└────────┬──────────┘
 ▼
Stored hash: "$2b$12$LJ3m4ys3Lg0Yf7KlZ8K0VePXdRkSEqGNmFCS.sVGBHby/RASY7Y/G"

Algorithm Comparison#

Algorithm	Type	Memory-Hard	Recommended	Notes
Argon2id	KDF	Yes	✅ Best choice	Winner of Password Hashing Competition (2015)
bcrypt	KDF	No	✅ Excellent	Battle-tested since 1999, 72-byte password limit
scrypt	KDF	Yes	✅ Good	Memory-hard, harder to tune than argon2
PBKDF2	KDF	No	⚠️ Acceptable	SHA-256 variant only; GPU-friendly
SHA-256	Hash	No	❌ Never	No salt, no cost factor, GPU-crackable
MD5	Hash	No	❌ Never	Broken, collisions found, GPU-crackable

Implementation#

Python (argon2):

Authorisation

Mon, 01 Jan 0001 00:00:00 +0000

Authentication vs Authorisation#

Authentication proves who you are. Authorisation determines what you can do. A system can have perfect authentication and still be completely broken if authorisation is missing or bypassable.

Broken access control was the #1 risk in the OWASP Top 10 (2021), overtaking injection for the first time.

Access Control Models#

Role-Based Access Control (RBAC)#

Permissions are assigned to roles, and users are assigned to roles. Simple, widely understood, and sufficient for most applications.

OAuth 2.0 & OpenID Connect

Mon, 01 Jan 0001 00:00:00 +0000

Overview#

OAuth 2.0 is an authorisation framework that allows third-party applications to obtain limited access to a user’s resources without exposing their credentials. OpenID Connect (OIDC) is an identity layer built on top of OAuth 2.0 that adds authentication.

Protocol	Purpose	Result
OAuth 2.0	Authorisation (what can the app do?)	Access Token
OpenID Connect	Authentication (who is the user?)	ID Token + Access Token

OAuth 2.0 Roles#

Role	Description
Resource Owner	The user who owns the data
Client	The application requesting access
Authorization Server	Issues tokens (e.g., Keycloak, Auth0, Okta)
Resource Server	The API that holds protected resources

Grant Types#

Authorization Code (with PKCE) — Recommended for All Clients#

This is the only recommended grant for browser-based and mobile applications. PKCE (Proof Key for Code Exchange) prevents authorisation code interception.

CSRF & Other Attacks

Mon, 01 Jan 0001 00:00:00 +0000

Cross-Site Request Forgery (CSRF)#

CSRF tricks a victim’s browser into making an unwanted request to a site where the victim is authenticated. The browser automatically attaches cookies (including session cookies), so the server cannot distinguish between a legitimate request and a forged one.

How CSRF Works#

1. Victim logs into bank.com (session cookie set)
2. Victim visits evil.com
3. evil.com contains:
 <form action="https://bank.com/transfer" method="POST">
 <input type="hidden" name="to" value="attacker">
 <input type="hidden" name="amount" value="10000">
 </form>
 <script>document.forms[0].submit()</script>
4. Browser sends the POST to bank.com WITH the session cookie
5. bank.com processes the transfer — it sees a valid session

CSRF Attack Variants#

Vector	Technique
Auto-submitting form	`<form>` + `<script>document.forms[0].submit()</script>`
Image tag (GET only)	`<img src="https://bank.com/transfer?to=attacker&amount=10000">`
XMLHttpRequest	Blocked by CORS for non-simple requests, but simple requests (form POST) pass
Fetch API	Same CORS restrictions apply

Prevention: SameSite Cookies#

The SameSite cookie attribute controls when cookies are sent with cross-site requests:

Transport Security

Mon, 01 Jan 0001 00:00:00 +0000

Why Transport Security Matters#

Data in transit is vulnerable to interception, modification, and replay. Without transport security, an attacker on the same network (coffee shop Wi-Fi, compromised router, ISP-level surveillance) can read passwords, session tokens, and personal data in plaintext.

Transport security is not optional — it is the foundation on which all other web security controls depend.

TLS (Transport Layer Security)#

TLS encrypts the communication channel between client and server. HTTPS is HTTP over TLS.

API Security

Mon, 01 Jan 0001 00:00:00 +0000

Why API Security Is Different#

APIs are the primary attack surface of modern applications. Unlike server-rendered pages, APIs expose raw business logic directly. They are consumed by browsers, mobile apps, third-party integrations, and automated scripts — each with different trust levels.

The OWASP API Security Top 10 (2023) highlights risks specific to APIs that the standard Top 10 does not adequately cover.

Input Validation#

Every API endpoint must validate every input. Never trust the client — not the browser, not the mobile app, not a trusted partner’s integration.

Security Testing & Operations

Mon, 01 Jan 0001 00:00:00 +0000

Security in the Development Lifecycle#

Security testing is not a one-time gate before release. It is a continuous process woven into every stage of the software development lifecycle — from the first line of code to production monitoring.

┌─────────┐ ┌──────────┐ ┌──────────┐ ┌──────────┐ ┌───────────┐
│ Code │──▶│ Build │──▶│ Test │──▶│ Deploy │──▶│ Monitor │
│ │ │ │ │ │ │ │ │ │
│ SAST │ │ SCA │ │ DAST │ │ Headers │ │ WAF logs │
│ Linting │ │ License │ │ Pentest │ │ TLS │ │ Alerting │
│ Secrets │ │ SBOM │ │ Fuzzing │ │ Config │ │ Incident │
└─────────┘ └──────────┘ └──────────┘ └──────────┘ └───────────┘

SAST (Static Application Security Testing)#

SAST analyses source code (or bytecode) without executing it. It finds vulnerabilities in the code itself — injection flaws, hardcoded secrets, insecure configurations.