Web Security
Important security concepts for modern web applications.
Terms in Web Security
Brute Force Attack
A brute force attack repeatedly tries possible credentials or values until a valid one is found.
CORS
Cross-Origin Resource Sharing controls which origins may access resources from a different origin.
CSRF
Cross-Site Request Forgery tricks an authenticated browser into sending an unintended state-changing request.
Clickjacking
Clickjacking tricks users into interacting with hidden or disguised interface elements.
Content Security Policy
CSP is a browser security mechanism that restricts which resources a page may load or execute.
Defense in Depth
Defense in depth uses multiple independent security controls so that one failure does not expose the entire system.
HTTPS
HTTPS protects HTTP communication using TLS encryption.
HttpOnly Cookie
The HttpOnly attribute prevents client-side JavaScript from directly reading a cookie.
Input Validation
Input validation checks incoming data against expected rules before processing it.
Output Encoding
Output encoding converts data into a safe representation for its destination context.
Rate Limiting
Rate limiting restricts how frequently a client can perform an operation.
SQL Injection
SQL injection occurs when untrusted input changes the meaning of a database query.
SameSite Cookie
The SameSite cookie attribute controls whether cookies are sent with cross-site requests.
Secrets Management
Secrets management protects sensitive values such as API keys and database passwords.
Secure Cookie
A secure cookie uses browser cookie attributes that reduce exposure during transmission or client-side access.
Security Headers
Security headers communicate browser security policies through HTTP response headers.
Security Misconfiguration
Security misconfiguration occurs when applications or infrastructure use unsafe or unnecessary settings.
TLS
TLS provides encryption, integrity, and authentication for network communication.
Threat Modeling
Threat modeling systematically identifies assets, threats, vulnerabilities, and mitigations.
Web Security
Web security is the practice of protecting web applications, users, data, and infrastructure from attacks.
XSS
Cross-Site Scripting occurs when untrusted content is interpreted as executable script in a user's browser.