Skip to main content

Security

Security Overview

These notes cover web security from principles to practical vulnerabilities, including defense strategies and best practices for building secure applications.

Core Concepts​

  • Web - Security headers, same-origin policy, CSP, trusted types, crypto, and user privacy
  • Sandbox - Snapshot, proxy, and iframe sandbox techniques
  • Zero Trust - Zero trust architecture and access control

Common Vulnerabilities​

Injection Attacks​

  • XSS - Cross-site scripting attacks and protections
  • CSRF - Cross-site request forgery attacks and protections
  • SQL Injection - SQL injection attacks and protections
  • Command Injection - Command injection attacks and protections
  • HTTP Injection - HTTP injection including malicious redirects and header injection
  • Object Injection - Object injection attacks and insecure object comparison
  • XML - XML bombs and external entity attacks

Authentication and Session​

  • Authentication - Password attacks, user enumeration, and authentication protections
  • Session - Session hijacking and fixation protections

Miscellaneous Vulnerabilities​

Supply Chain​

  • Supply Chain - Supply chain attacks, malicious packages, and protection strategies

LLM Security​

Best Practices​

  • Best Practices - Security principles, defensive programming, checklist, and references