I85PREP
⌘ K
WBCHSE HS Cyber Security study materials
WBCHSE HS Cyber Security study resources

WBCHSE HS Cyber Security: Web and Application Security

WBCHSE HS Cyber Security · Work through your exam, one topic at a time.

All guide sections

Web and Application Security

Domain focus

Web and Application Security tests how web applications fail and how to prevent common weaknesses: injection, cross-site scripting, CSRF, broken access control, insecure sessions and unsafe file upload.

Core rules and concepts

  • Validate input on the server, not only in the browser; client-side checks are user convenience, not a security boundary.
  • Use parameterised queries or prepared statements to stop SQL injection; do not build queries by string concatenation.
  • Encode output for the correct context to reduce XSS; HTML, attribute, JavaScript and URL contexts need different handling.
  • Enforce authorisation on every request; hiding a button is not access control. Avoid insecure direct object references by checking ownership.
  • Use HTTPS, Secure and HttpOnly cookies, and SameSite settings; regenerate session IDs after login.
  • CSRF defences include anti-CSRF tokens and suitable SameSite cookie settings.

Worked example

A login form builds a query as text plus username plus password. An attacker enters a crafted username that changes the query logic. The fix is a parameterised query, server-side validation, least-privilege database accounts and generic error messages. Reasoning: the database treats supplied data as data, not code; least privilege limits damage if injection still occurs elsewhere.

Traps that cost marks

Do not rely on JavaScript validation alone. Do not say HTTPS prevents XSS or SQL injection. Do not use HTML encoding inside a JavaScript context. Do not treat authentication as authorisation. Do not store sensitive data in URLs. Do not assume a CSRF token replaces session security.