Tell about web application security: SQL injections, XSS, CSRF, CSP, CORS, rate limiting, and others.
sobes.tech AI
Answer from AI
Web application security includes protection against various attacks:
-
SQL Injection — injecting malicious SQL commands through user input. Protected by parameterized queries and ORM.
-
XSS (Cross-Site Scripting) — injecting malicious JavaScript into pages, which are then executed by other users. Protection includes output escaping and Content Security Policy (CSP).
-
CSRF (Cross-Site Request Forgery) — an attack where an attacker tricks a user into performing unwanted actions. Protection involves using CSRF tokens and checking the Origin/Referer headers.
-
CSP (Content Security Policy) — a security policy that restricts content sources (scripts, styles, etc.), reducing XSS risk.
-
CORS (Cross-Origin Resource Sharing) — a mechanism controlling access to resources from other domains. Proper CORS configuration prevents unwanted access.
-
Rate limiting — limiting the number of requests from a single IP or user over a period to prevent DDoS and brute-force attacks.
Other measures:
- Using HTTPS to encrypt traffic.
- Storing passwords with salt and hashing.
- Regularly updating dependencies and patches.
- Validating and sanitizing all user data.
Example CSP header:
Content-Security-Policy: default-src 'self'; script-src 'self' https://trusted.cdn.com;
It allows scripts to load only from the own domain and trusted CDN.