Web Security
Web security protects web applications and their users from attacks that exploit the HTTP model, browser trust, and server-side processing. It covers vulnerabilities like cross-site scripting, injection, authentication flaws, and the defensive controls that neutralize them.
itWeb development | OpenSkills.info
Intro
Web Security
Web security is the work of keeping a web application’s data and actions available only to the people and systems that should use them, while making abuse detectable and containable. It is not a browser-header exercise. A request travels through the browser, network edge, application, data stores, identity provider, dependencies, and deployment system. Each handoff is a trust boundary.
The useful question is not "is this page secure?" Ask what the requester can cause the system to do, what data can cross the boundary, and which component makes the final decision. The application server must decide whether an authenticated identity may perform a requested action on a specific object. A hidden button, a client-side route check, or an identifier that looks hard to guess does not make that decision.
The mental model
Continue the course
This section is part of the paid course.
See pricing to subscribe, or log in if you already have access.
Where this skill leads
Relevant careers
See how this topic contributes to broader role-level skill maps.
Sources
- https://owasp.org/Top10/2025/0x00_2025-Introduction/
Supports
- OWASP Top 10 2025 categories and its role as an awareness document
- The 2025 risk categories named in the introduction and slides
- https://owasp.org/Top10/2025/A01_2025-Broken_Access_Control/
Supports
- Broken access control as a web application risk
- Object-level authorization scenarios used in the course and quiz
- https://owasp.org/Top10/2025/A05_2025-Injection/
Supports
- Injection as a web application risk
- The need to prevent untrusted data from becoming interpreter syntax
- https://owasp.org/www-project-application-security-verification-standard/
Supports
- ASVS as a basis for testing web application security controls
- ASVS as secure-development guidance and a verification baseline
- The current stable ASVS version 5.0.0
- https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html
Supports
- Authentication as verification of an identity claim
- The relationship among authentication and session management
- https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html
Supports
- HTTP session purpose and the relation among authentication, sessions, and access control
- Session identifier renewal after privilege changes and session invalidation
- Session identifiers as untrusted input and session expiration guidance
- https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html
Supports
- Context-specific output encoding for HTML, attributes, URLs, CSS, and JavaScript
- Dangerous contexts where untrusted variables should not be placed
- HTML sanitization when users must author HTML
- CSP as a supplementary rather than sole XSS control
- https://cheatsheetseries.owasp.org/cheatsheets/Transport_Layer_Security_Cheat_Sheet.html
Supports
- TLS 1.3 by default and TLS 1.2 compatibility guidance
- HTTPS redirects, HSTS, and the Secure cookie flag
- https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy
Supports
- Content Security Policy as an HTTP response header that controls resources a user agent may load
- CSP report-only deployment and policy behavior
- https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Set-Cookie
Supports
- Secure, HttpOnly, and SameSite cookie attributes
- HttpOnly preventing JavaScript access while allowing request sending
- https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html
Supports
- Security logging design, sensitive-data handling, and secure log transport
- Logging as a detection and investigation control