Web Application and Database Security
Stub. The standard web application vulnerability classes (XSS, CSRF, and the same-origin policy that partially defends against them), SQL injection and other injection attacks against a backend database, and database-level access control.
Web application security is memory-corruption-style thinking applied to a different trust boundary: instead of a stack buffer, the attack surface is untrusted input flowing into a query, a page, or another user’s browser. Covers cross-site scripting (XSS — injected script executed in a victim’s browser session) and cross-site request forgery (CSRF — a victim’s authenticated session used to issue an unintended request), the same-origin policy as the browser’s main defense boundary, and SQL injection as the same “unescaped input becomes code” pattern one layer down, at the database. Closes with database-level access control (grants, views, row-level security) as a second line of defense when application- layer input validation fails.
Outline (TODO — flesh out each)
- Cross-site scripting (XSS)
- Cross-site request forgery (CSRF)
- The same-origin policy
- SQL injection and other injection attacks
- Database access control