Web Security, APIs, and Browser Threats
Why web security is difficult
The challenge
Browsers, APIs, and web applications sit at the boundary between users and servers. They must handle untrusted input, manage sessions, and enforce authorization while remaining usable and fast.
Common web threats
| Threat | What it targets |
|---|---|
| Cross-site scripting | User browsers and session data |
| Cross-site request forgery | Trusted browser sessions |
| SQL injection | Backend databases and query logic |
| Broken authentication | Login flows and session tokens |
Web defense concepts
API security habit
Treat APIs as products: authenticate every request, authorize every object, rate limit misuse, and log access patterns.
Session protection options
Cookie-based session
- Common in web apps
- Depends on secure cookie attributes and CSRF defenses
Token-based session
- Often used by APIs and mobile apps
- Requires careful storage and expiry handling
Which attack is most associated with injecting malicious script into a page viewed by other users?
XSS runs attacker-controlled script in a victim's browser context.
Correct answer: Cross-site scripting
What is the purpose of a CSRF token?
It helps prevent unauthorized cross-site requests using the victim's browser session.
Correct answer: To prove a request was intentionally generated by the legitimate site or form
Which control helps reduce script access to session cookies?
HttpOnly reduces exposure of cookies to client-side scripts.
Correct answer: HttpOnly
Why is authorization on every API object important?
Object-level authorization prevents broken access control.
Correct answer: Because users may be authenticated but still not allowed to access specific records or actions