CAP-PC ENS: Web Application Security study guide

What this domain tests

Web Application Security questions here start from observed behaviour and ask you to name the root cause and the exact missing control. Authentication, session handling, injection, request forgery and server-side request flows all appear. Marks go to candidates who identify the precise broken boundary, not to those who recite category names.

Core decision rules

Classify the defect before naming a fix: missing authentication, missing object-level authorization, or a broken parsing/encoding boundary. These have different remediations and exam distractors blur them deliberately.
Injection is a context problem. SQL, HTML, LDAP, shell and JSON each need a different encoder. HTML-escaping a value that lands inside a JavaScript string or a URL attribute protects nothing.
Server-side fetch features need destination allowlists, resolve-then-connect to defeat DNS rebinding, and explicit blocking of link-local metadata addresses such as 169.254.169.254 and redirects pointing at them.
Session cookies with HttpOnly, Secure and SameSite are defence in depth; they do not replace an anti-CSRF token on state-changing requests.

Worked example

An API serves invoices at GET /api/invoices/{id} with this handler:

if not session.get("user_id"): return 401
row = db.query("SELECT * FROM invoices WHERE id = ?", id)
return row

Authentication is present; authorization is not. The path identifier is user-controlled and selects the object directly, and nothing ties row.owner_id to the session value. Confirm with two requests: an id owned by another tenant should not return 200. The durable fix is at the query layer, WHERE id = ? AND owner_id = ?, returning 404 on a miss so existence is not leaked. A controller-level if after the fetch is weaker because every future code path must remember it.

Traps that cost marks

Reading logged-in as authorized, and treating a 401 check as covering object ownership.
Fixing a SQL injection finding with HTML encoding because the payload looked like markup.
Trusting Content-Type: application/json to prevent XSS; content sniffing and JSONP callbacks still land in an HTML parser.
A CSP delivered in report-only mode changes no behaviour.
Blocklisting <script> fails against attribute contexts, javascript: URLs and event handlers.