Introduction To Web Security
Web Security is the practice of protecting websites, web applications, and users from cyber threats.
Every time you visit a website, enter a password, submit a form, or make a payment, security mechanisms are working in the background to protect your data.
What Is Web Security
Web Security refers to the protective measures taken to:
Web security focuses specifically on applications that run in web browsers and communicate over the internet.
Why Web Security Is Important
Web applications often handle:
If a web application is not secure:
Security protects both users and organizations.
Core Security Goals (CIA Triad)
There are three main goals in security:
Confidentiality
Only authorized people can access information.
Integrity
Data cannot be modified without authorization.
Availability
Systems remain accessible and functional.
Web security aims to achieve all three.
Common Web Threats
Understanding threats helps us understand protection.
Injection Attacks
Attackers insert malicious code into input fields.
Cross-Site Scripting (XSS)
Attackers inject scripts into web pages viewed by other users.
Cross-Site Request Forgery (CSRF)
Attackers trick users into performing unwanted actions.
Session Hijacking
Attackers steal session cookies to impersonate users.
Man-In-The-Middle (MITM)
Attackers intercept communication between user and server.
Example Of An Injection Vulnerability
Imagine a login system that directly inserts user input into a database query.
Unsafe example:
username = input("Enter username: ")
password = input("Enter password: ")
query = "SELECT * FROM users WHERE username = '" + username + "' AND password = '" + password + "'"
print(query)
If a user enters malicious input, the query can be manipulated.
This is dangerous because user input is not validated or sanitized.
Secure Coding Practice Example
Safer version using parameterized queries (conceptual example):
username = input("Enter username: ")
password = input("Enter password: ")
query = "SELECT * FROM users WHERE username = ? AND password = ?"
print("Using parameterized query:", query)
Parameterized queries prevent user input from being treated as executable code.
Importance Of HTTPS
Websites must use HTTPS instead of HTTP.
HTTPS:
Without HTTPS, data travels in plain text.
Authentication And Authorization
Authentication
Verifies who the user is.
Example:
Logging in with username and password.
Authorization
Determines what the user is allowed to do.
Example:
Admin can delete users.
Regular user cannot.
Both are essential for security.
Password Security
Weak passwords are a major security risk.
Best practices:
Example of hashing (conceptual):
import hashlib password = "my_secure_password" hashed_password = hashlib.sha256(password.encode()).hexdigest() print(hashed_password)
Hashing ensures the server does not store plain text passwords.
Session Management
After login, servers create a session.
The session is usually stored in a cookie.
Example cookie:
Set-Cookie: session_id=abc123; HttpOnly; Secure
Best practices:
Input Validation
All user input must be validated.
Example of simple input validation:
age = input("Enter age: ")
if age.isdigit():
print("Valid age")
else:
print("Invalid input")
Never trust user input.
Validate on both client and server sides.
Security Headers
Web servers can send special headers to improve security.
Examples:
Content-Security-Policy
Prevents unauthorized scripts.
X-Frame-Options
Prevents clickjacking.
Strict-Transport-Security
Forces HTTPS usage.
Example:
Content-Security-Policy: default-src 'self' X-Frame-Options: DENY Strict-Transport-Security: max-age=31536000
Regular Updates And Patch Management
Many attacks target outdated software.
Best practices:
Unpatched systems are vulnerable systems.
Principle Of Least Privilege
Users and applications should only have the permissions they need.
Example:
Limiting privileges reduces damage if compromised.
Logging And Monitoring
Security is not only prevention.
It also includes detection.
Monitor:
Logs help identify and respond to attacks.
Defense In Depth
Web security should use multiple layers:
No single control is enough.
Layered security reduces risk.
# Unsafe SQL query example
username = input("Enter username: ")
password = input("Enter password: ")
query = "SELECT * FROM users WHERE username = '" + username + "' AND password = '" + password + "'"
print(query)
# Safer parameterized query example
username = input("Enter username: ")
password = input("Enter password: ")
query = "SELECT * FROM users WHERE username = ? AND password = ?"
print("Using parameterized query:", query)
# Password hashing example
import hashlib
password = "my_secure_password"
hashed_password = hashlib.sha256(password.encode()).hexdigest()
print(hashed_password)
# Simple input validation
age = input("Enter age: ")
if age.isdigit():
print("Valid age")
else:
print("Invalid input")
# Example secure headers
Content-Security-Policy: default-src 'self'
X-Frame-Options: DENY
Strict-Transport-Security: max-age=31536000
# Example secure cookie
Set-Cookie: session_id=abc123; HttpOnly; Secure