Binary Semaphorelearn
sign in

Study Notebook / 05

Backend Security

Where you made an assumption, and who is going to find it

Every vulnerability is an assumption someone else found first. Injection across SQL, NoSQL and the shell, password storage done properly, sessions and tokens, and the boundaries where data turns into code.

pages
55
sections
35
editions
Reading, Print, Tablet

Sign in to read it

The whole notebook is free for 7 days. No card, no payment. We ask for an account so the download link belongs to someone.

Sign in with GitHub or Google

What is inside

The full table of contents. Nothing here is hidden: if a section you need is not in this list, the notebook is not the right one and you should not spend a week on it.

  1. The whole book in one question
  2. 1. Assumptions are the vulnerability
  3. 2. Your application speaks several languages
  4. 3. The boundary between data and code
  5. 4. SQL injection
  6. 5. Parameterised queries, and what they cannot do
  7. 6. NoSQL injection
  8. 7. Command injection
  9. 8. The argument array
  10. 9. Build it only if you have a reason
  11. 10. Never store a password
  12. 11. Why hashing alone is not enough
  13. 12. Salt, and the right algorithm
  14. 13. Sessions
  15. 14. Cookie flags
  16. 15. JWT: what you gain and what you give up
  17. 16. Rate limiting
  18. 17. The layer where the check belongs
  19. 18. Broken object level authorization
  20. 19. What the status code leaks
  21. 20. Deny by default
  22. 21. Audit logging
  23. 22. Cross-site scripting
  24. 23. Content Security Policy
  25. 24. Cross-site request forgery
  26. 25. Clickjacking
  27. 26. Secrets
  28. 27. Error messages and debug output
  29. 28. What you must not log
  30. 29. Dependencies
  31. 30. Reviewing an endpoint
  32. 31. Follow-up question bank
  33. Appendix A. The response headers
  34. Appendix B. Glossary
  35. Appendix C. Self-test

How to read it

Read with a pen. Every notebook opens with a question to answer before you start and asks you to redo the answer at the end, and the margin in the Print edition exists so you have somewhere to be wrong first. The Tablet edition is 16:9 with vector text, so note apps draw on it rather than treating it as a photograph.

more notebooks