Web security basics

The eighth chapter begins the protection of web systems with a way of thinking: what do we protect, from whom, and where does data cross a trust boundary. It presents the browser's isolation rules (same-origin policy, CORS), then the three most important families of attack, XSS, CSRF, and injection, on real, executed examples. It covers the protection of passwords, multi-factor authentication, and sessions, and closes with a security review in the spirit of OWASP.

• Threat models and trust boundaries
• Same-origin policy and CORS
• XSS: when data becomes code
• CSRF: a request triggered by a foreign page
• Injection: when data becomes a command
• Passwords, multi-factor authentication, and session protection
• The OWASP approach and a security review of a web application