Web Application Security
What this domain tests
Web Application Security tests whether you can trace untrusted input from a request to a security-sensitive sink and whether you understand where authorization, session handling, and output encoding actually belong. The exam favors concrete mechanics over memorized category names.
Core rules
- Authorization is a server-side decision made for every object and every function. Hiding a button is user-interface convenience, not access control.
- Injection defenses separate code from data: parameterized queries for SQL, safe APIs instead of shell strings, and context-specific output encoding for HTML, attribute, JavaScript, and URL contexts.
- Session cookies need HttpOnly, Secure, and an appropriate SameSite value; rotate the session identifier after login and privilege change.
- CSRF matters when the browser attaches ambient credentials automatically. A JSON API using an Authorization header is not automatically CSRF-protected, but it has other risks.
- SSRF defenses must validate the resolved destination, block link-local and metadata addresses, and prefer an allowlist over a deny list.
Worked example
You have two accounts, A and B. While signed in as A, request /api/invoices/1042; the response contains A's invoice. Change the path to /api/invoices/1043 and you receive B's invoice with HTTP 200. The identifier is direct and the server is not scoping the lookup to the authenticated subject. This is broken object-level authorization, not a guessing problem. Fix it by making the query WHERE id = ? AND owner_id = ? and returning 404 for records the caller does not own. Retest with both accounts and with a token from a third tenant.
Traps that cost marks
- Calling reflected XSS stored XSS because the payload appears in the response.
- Treating 401 and 403 as interchangeable; 401 means unauthenticated, 403 means authenticated but forbidden.
- Assuming client-side validation or a WAF is an authorization control.
- Testing only the happy path and missing mass assignment, forced browsing, and HTTP method changes.