Security Engineering
Web Security Basics
Defend the most common attack classes: injection, XSS, and weak authentication.
Learning objectives
- Prevent injection attacks
- Mitigate cross-site scripting (XSS)
- Enforce strong authentication practices
Injection attacks
Injection happens when untrusted user input is treated as code or as part of a command. The universal cure is to never build commands or queries from concatenated input: use the safe, parameterized interfaces provided by your platform or framework, and validate input at the boundary before it reaches any system.
Cross-site scripting (XSS)
XSS occurs when unescaped input is rendered as HTML. Always escape output and treat every user-supplied value as untrusted, no matter where it originated.
Authentication hygiene
- Hash passwords with a modern algorithm such as bcrypt.
- Enforce strong, unique passwords.
- Add multi-factor authentication for privileged accounts.
Key takeaways
- Treat all user input as untrusted and route it through parameterized interfaces.
- Escape output to neutralize XSS.
- Authentication is a system, not a single field.