Web Application Security Fundamentals
How Web Apps Work
Request and Response
A web application exchanges requests and responses between a client, application logic, and backend data stores. Security issues often appear when input is trusted too much, access control is weak, or secrets are exposed.
Important Components
Think Like an Input Handler
Ask where user input enters the system, how it is validated, and what assumptions the server makes about it.
Common Web Weakness Themes
Typical problem areas include authentication failures, broken access control, insecure direct object references, injection, cross-site scripting, insecure file handling, and weak session management.
Which layer is most directly responsible for processing user input and business logic?
Application logic processes input and makes trust decisions, so it is often the source of security failures.
Correct answer: Application server
What is a session used for in a web app?
Sessions let the app remember who the user is or what they are doing.
Correct answer: To maintain state across multiple requests from the same user.
Interpreting Authentication and Access Control
Two Different Defenses
Authentication verifies identity, while authorization decides what an authenticated identity can do. Many serious issues happen when these two controls are confused or implemented inconsistently.
Which statement best describes authorization?
Authorization governs permissions after identity has been established.
Correct answer: Deciding what a user may access
Why do web applications often have a larger attack surface than simple websites?
More features and state create more opportunities for mistakes.
Correct answer: Because they contain dynamic logic, input handling, sessions, APIs, and data access paths.