Reference · 64 terms
Glossary
Every short form used across the series. Inside a lesson, hover or tap any dotted term to see the same entry in place.
Mindset
- attack surfaceAttack surface
- All the places where an attacker can reach your system: URLs, form fields, headers, uploads, logins and dependencies.Lesson 0 →
- defence in depthDefence in depth
- Using several layers of protection, so one mistake in one layer is not the end.Lesson 0 →
- least privilegePrinciple of least privilege
- Give every user, program and key only the permissions its job needs, so the damage stays small if it is stolen or buggy.Lesson 0 →
- OWASP Top 10OWASP Top 10
- A free list of the ten most serious kinds of web app risk, updated every few years. Always say which edition you mean.Lesson 0 →
- STRIDESTRIDE
- Six prompts for finding threats: spoofing, tampering, repudiation, information disclosure, denial of service and elevation of privilege.Lesson 0 →
- threat modelThreat modelling
- Thinking about what can go wrong before it does, by asking four questions about your system.Lesson 0 →
- trust boundaryTrust boundary
- A line where data moves from a place you control to a place you do not, such as from the browser to your server.Lesson 0 →
Injection
- allow-listAllow-list
- A list of the only values you accept, such as the column names a user may sort by. Everything else is refused.Lesson 1 →
- command injectionOS command injection
- User input reaches a shell command, so characters like ; or && add extra commands. Prefer execFile or a library over exec.Lesson 1 →
- NoSQL injectionNoSQL injection
- An attacker sends an object with an operator like $ne where you expected a plain string, which changes what the query matches.Lesson 1 →
- parameterised queryParameterised query (prepared statement)
- A query where the SQL text and the values are sent separately, so a value can never change the meaning of the SQL.Lesson 1 →
- SQL injectionSQL injection
- User input is joined into a SQL query, so the database reads the input as SQL. Fix it with parameterised queries.Lesson 1 →
Browser attacks
- clickjackingClickjacking
- A bad page loads your site in an invisible frame so the user's click lands on your real button. Stop it with frame-ancestors.Lesson 2 →
- CSPContent Security Policy
- A response header that tells the browser what scripts and resources it may run or load. It limits the damage if a script gets injected.Lesson 2 →
- CSRFCross-site request forgery
- Another site makes the user's browser send a request to your site, and the browser attaches the user's cookie automatically.Lesson 2 →
- CSRF tokenCSRF token
- A random, session-bound secret put in each form and checked by the server. A different site cannot read it, so it cannot forge the request.Lesson 2 →
- frame-ancestorsCSP frame-ancestors
- A CSP setting that lists which sites may put your page inside a frame. 'none' means nobody.Lesson 2 →
- helmethelmet (npm package)
- A Node package that sets a group of security response headers for you. You still need to tune the CSP and set cookie flags yourself.Lesson 2 →
- output encodingOutput encoding
- Changing special characters such as < into safe codes such as < so the browser shows them as text, not as HTML.Lesson 2 →
- XSSCross-site scripting
- An attacker's JavaScript runs in another user's browser on your site, because user text was put into the page without encoding.Lesson 2 →
Passwords and login
- Argon2idArgon2id
- OWASP's first choice for storing passwords. A slow, memory-hard hash that resists both graphics-card and side-channel attacks.Lesson 3 →
- credential stuffingCredential stuffing
- Trying email and password pairs leaked from other sites on your login page, hoping people reused passwords.Lesson 3 →
- saltSalt
- A random value, new for every password, mixed in before hashing so two users with the same password get different hashes. It is not secret.Lesson 3 →
- slow hashSlow hash (password hashing function)
- A hash made on purpose to be slow and memory hungry, such as Argon2id, scrypt, bcrypt or PBKDF2, so each password guess costs the attacker time.Lesson 3 →
- TOTPTime-based one-time password
- The 6-digit code from an authenticator app (RFC 6238). It comes from a shared secret and the current 30-second time step, using HMAC.Lesson 3 →
- user enumerationUser enumeration
- Finding out which accounts exist because the login or reset page answers differently for known and unknown emails. Use one generic message.Lesson 3 →
Sessions and tokens
- alg noneJWT alg none attack
- A JWT attack where the header claims no signature is needed. It works only if the server trusts the algorithm named in the token instead of fixing it in code.Lesson 3 →
- HttpOnlyHttpOnly cookie flag
- A cookie setting that hides the cookie from JavaScript, so a script injected by XSS cannot read the session ID directly.Lesson 3 →
- session fixationSession fixation
- An attack where the attacker plants a known session ID in the victim's browser and uses it after the victim logs in. Fix it by making a new ID at login.Lesson 3 →
Access control
- allow-listAllow-list
- A list of the only things permitted, such as the fields a user may edit. Safer than a block-list, which lets through anything you forgot to name.Lesson 4 →
- deny by defaultDeny by default
- If no rule clearly allows a request, the answer is no. A route someone forgot to protect is then closed, not open.Lesson 4 →
- IDORInsecure Direct Object Reference
- A bug where the server uses an ID from the request, like /notes/2, to fetch a record without checking that the caller may see it.Lesson 4 →
- mass assignmentMass assignment
- A bug where the server copies every field of the request body into a record, so a user can set fields like role or plan that they should never control.Lesson 4 →
- RBACRole-based access control
- Deciding access by the user's role, such as admin or user. Good for broad powers, but not enough to protect each user's own records.Lesson 4 →
Secrets and crypto
- AES-256-GCMAES-256-GCM
- A common way to encrypt data with a 256-bit key. It also adds a tag, so any change to the data makes decryption fail on purpose.Lesson 5 →
- CSPRNGCryptographically secure random number generator
- A random source whose output cannot be predicted. In Node use crypto.randomBytes, never Math.random, for tokens, keys and IDs.Lesson 5 →
- HSTSHTTP Strict Transport Security
- A response header that tells the browser to always use HTTPS for your site for a set time, and not to allow clicking through certificate warnings.Lesson 5 →
- key rotationKey rotation
- Replacing a secret with a new one and turning the old one off. When a secret leaks, rotate first, then clean up.Lesson 5 →
- NEXT_PUBLIC_NEXT_PUBLIC_ prefix
- In Next.js, variables with this prefix are written into the browser bundle at build time, so they are public. Never use it for a real secret.Lesson 5 →
- nonceNonce / IV
- A number that must be new for every encryption with the same key. For AES-GCM use 12 random bytes each time and store them with the data.Lesson 5 →
- secret scanningSecret scanning
- Tools that search code and git history for things that look like keys. Push protection blocks a push that contains one.Lesson 5 →
Personal data
- PIIPersonally identifiable information
- Data about a real person that can identify them, such as name, email, phone, address or ID number. Collect less, keep it shorter, and keep it out of logs.Lesson 5 →
Supply chain
- --ignore-scripts--ignore-scripts
- An npm option that stops install scripts from running; it does not stop the package's code when you import it later.Lesson 6 →
- DependabotDependabot
- A GitHub bot that raises alerts and opens pull requests to update vulnerable or old dependencies.Lesson 6 →
- install scriptInstall script (lifecycle script)
- A command in package.json, such as postinstall, that npm runs automatically when the package is installed.Lesson 6 →
- lock fileLock file (package-lock.json)
- A file that records the exact version, address and checksum of every installed package so installs repeat exactly.Lesson 6 →
- npm auditnpm audit
- An npm command that compares your installed packages with a list of known vulnerabilities and exits non-zero if it finds any.Lesson 6 →
- npm cinpm ci
- An npm command that installs exactly what the lock file says and fails if the lock file and package.json disagree.Lesson 6 →
- pinningPinning (commit SHA)
- Fixing a dependency or action to an exact version or full commit hash so it cannot change under you.Lesson 6 →
- push protectionPush protection (secret scanning)
- A GitHub feature that looks for keys and tokens in your code and blocks a push that contains one.Lesson 6 →
- supply chainSoftware supply chain
- Everything in your software that you did not write: packages, build tools, CI actions, and the accounts and servers that publish them.Lesson 6 →
- typosquattingTyposquatting
- Publishing a package with a name that looks like a popular one and waiting for someone to mistype it.Lesson 6 →
APIs and servers
- allow-listAllow-list
- A list of what is permitted, with everything else refused; safer than a deny-list of what is forbidden.Lesson 7 →
- BOLABOLA (broken object level authorization)
- Getting another user's data by changing an object ID because the server never checked ownership; API1 in the OWASP API Top 10.Lesson 7 →
- CORSCORS (cross-origin resource sharing)
- Response headers that tell the browser which other websites may read this server's responses; the browser enforces it, not the server.Lesson 7 →
- DNS rebindingDNS rebinding
- A trick where a name points to a safe address when you check it and to a private address when you connect.Lesson 7 →
- path traversalPath traversal
- Using ../ in a file name to climb out of the folder a program meant to use.Lesson 7 →
- rate limitingRate limiting (429, Retry-After)
- Refusing a client that sends too many requests in a time window, with status 429 and a Retry-After header.Lesson 7 →
- SSRFSSRF (server-side request forgery)
- An attack where you make a server fetch a URL of your choice, so it reaches internal places you could not reach yourself.Lesson 7 →
Practice
- DASTDAST (dynamic application security testing)
- A tool that attacks a running app from outside and checks the responses, such as OWASP ZAP.Lesson 8 →
- SASTSAST (static application security testing)
- A tool that reads your source code without running it and looks for dangerous patterns, such as Semgrep or CodeQL.Lesson 8 →
- SCASCA (software composition analysis)
- A check of the packages you use against known vulnerabilities, such as npm audit.Lesson 8 →
- security championSecurity champion
- A developer on a team who takes extra interest in security and helps others, without being a full-time security person.Lesson 8 →
- threat modelThreat model (STRIDE)
- A short answer to what are we building, what can go wrong and what do we do about it; STRIDE is a memory aid for six threat types.Lesson 8 →