Study Notebook / 05
Backend Security
Where you made an assumption, and who is going to find it
Every vulnerability is an assumption someone else found first. Injection across SQL, NoSQL and the shell, password storage done properly, sessions and tokens, and the boundaries where data turns into code.
- pages
- 55
- sections
- 35
- editions
- Reading, Print, Tablet
Sign in to read it
Sign in and the whole notebook opens, all three editions with it. An account is what makes a download belong to someone.
Sign in with GitHub or GoogleStart reading
How to use this book
What is inside
Every section, and every one of them opens in the browser. Nothing here is hidden: if a section you need is not in this list, the notebook is not the right one and you should not spend a week on it.
- How to use this book
- The whole book in one question
- 1Assumptions are the vulnerability
- 2Your application speaks several languages
- 3The boundary between data and code
- 4SQL injection
- 5Parameterised queries, and what they cannot do
- 6NoSQL injection
- 7Command injection
- 8The argument array
- 9Build it only if you have a reason
- 10Never store a password
- 11Why hashing alone is not enough
- 12Salt, and the right algorithm
- 13Sessions
- 14Cookie flags
- 15JWT: what you gain and what you give up
- 16Rate limiting
- 17The layer where the check belongs
- 18Broken object level authorization
- 19What the status code leaks
- 20Deny by default
- 21Audit logging
- 22Cross-site scripting
- 23Content Security Policy
- 24Cross-site request forgery
- 25Clickjacking
- 26Secrets
- 27Error messages and debug output
- 28What you must not log
- 29Dependencies
- 30Reviewing an endpoint
- 31Follow-up question bank
- Appendix A. The response headers
- Appendix B. Glossary
- Appendix C. Self-test
How to read it
Read with a pen. Every notebook opens with a question to answer before you start and asks you to redo the answer at the end, and the margin in the Print edition exists so you have somewhere to be wrong first. The Tablet edition is 16:9 with vector text, so note apps draw on it rather than treating it as a photograph.