Web Security
Lesson 1 --- HTTP Model
Browser → Request → Server → Response. Trust assumptions create vulnerabilities.
Lesson 2 --- Broken Access Control
- Verify authorization on every request.
- Never trust IDs from the client.
- IDOR is changing identifiers to access another resource.
Lesson 3 --- Sessions
- Password authenticates once.
- Session authenticates every request.
- Session theft is often more valuable than password theft.
Lesson 4 --- Input Attacks
Core principle: Data must never become code.
Examples:
- SQL injection
- Cross-site scripting (XSS)
Lesson 5 --- CSRF
Authentication != Intent.
Defenses:
- CSRF tokens
- SameSite cookies
- Re-authentication for sensitive actions
Lesson 6 (next)
- Chain multiple weaknesses into realistic attack paths.