Web Application Security
The specific vulnerabilities behind most real breaches — SQL injection, XSS, CSRF, and how to actually fix each one.
1. What is Web Application Security?
Why web apps are the most common attack surface, and what this subject covers.
2. SQL Injection
What happens when user input is pasted directly into a database query, and how to stop it.
3. Cross-Site Scripting (XSS)
What happens when user input is rendered as HTML instead of text, and how to stop it.
4. Cross-Site Request Forgery (CSRF)
How a malicious site can make your browser perform an action on a site you're already logged into.
5. Authentication & Session Security
Keeping a user's logged-in session from being stolen or hijacked after they've proven who they are.
6. HTTPS & Secure Headers
Encrypting traffic in transit, and the response headers that close off common browser-level attacks.
7. Input Validation & Sanitization
Why every other fix in this subject depends on treating user input as untrusted by default.
8. A Web Security Checklist
The short version of everything in this subject, for whenever you're shipping a real form or endpoint.