Web Security

One small app, attacked and fixed.

This track follows one small web application, a notes service with accounts, from its first naive version to a hardened one. It runs locally, with a real browser driving it, so every attack shown actually ran and every fix was checked against the attack it is meant to stop.

Each chapter starts from a hole the previous one left open. The browser’s rule about origins explains why a page can’t simply read another site’s data, and also why it can still make the browser send requests there. Cookies carry the session, and that makes forged requests possible. Escaping output stops one kind of injected script, and the ones that remain lead to Content Security Policy. Further on, the attacks move to the server: input that becomes a query or a command, a server tricked into fetching for the attacker, users reaching data that isn’t theirs. The last chapters cover the connection and the domain the app is served from, and the code it depends on but didn’t write.

Login tokens, OAuth and sessions are covered in depth in the essay on JWTs, OAuth and Zero Trust, and the System Design security chapter covers the system-level view. This track stays close to the browser and the request.