Web Security

Lesson 1 --- HTTP Model

Browser → Request → Server → Response. Trust assumptions create vulnerabilities.

Lesson 2 --- Broken Access Control

  • Verify authorization on every request.
  • Never trust IDs from the client.
  • IDOR is changing identifiers to access another resource.

Lesson 3 --- Sessions

  • Password authenticates once.
  • Session authenticates every request.
  • Session theft is often more valuable than password theft.

Lesson 4 --- Input Attacks

Core principle: Data must never become code.

Examples:

  • SQL injection
  • Cross-site scripting (XSS)

Lesson 5 --- CSRF

Authentication != Intent.

Defenses:

  • CSRF tokens
  • SameSite cookies
  • Re-authentication for sensitive actions

Lesson 6 (next)

  • Chain multiple weaknesses into realistic attack paths.