Security in Web Applications Cheat Sheet

Updated 2026-04-27

🧠Study flashcards on this topic158 cards · spaced repetition→

Security in web applications protects digital assets from threats spanning injection attacks, broken authentication, data exposure, and misconfigurations. Modern web security operates at multiple layers—from transport encryption and input validation to session management and access control. The OWASP Top 10 2025 remains the definitive reference, with Broken Access Control at #1, Security Misconfiguration rising to #2, and new categories covering software supply chain failures and error handling. Effective security requires defense in depth, continuous monitoring, and awareness of emerging threats including API abuse, LLM prompt injection, and prototype pollution.

What This Cheat Sheet Covers

This topic spans 18 focused tables and 165 indexed concepts, 158 flashcards. Below is a complete table-by-table outline of this topic, spanning foundational concepts through advanced details.

Table 1: Common Injection AttacksTable 2: Authentication and AuthorizationTable 3: Input Validation and SanitizationTable 4: Session ManagementTable 5: Cross-Site Request Forgery (CSRF) ProtectionTable 6: Transport and CryptographyTable 7: Security HeadersTable 8: API SecurityTable 9: File Upload SecurityTable 10: Access ControlTable 11: Secure Development PracticesTable 12: Logging and MonitoringTable 13: Vulnerability Types and MitigationsTable 14: Directory and Path SecurityTable 15: Cloud and Infrastructure SecurityTable 16: Advanced Attack TechniquesTable 17: Secure ConfigurationTable 18: Modern Security Challenges

Quick IndexSubscribe to unlock

A jump-to index of every table row in this cheat sheet.

Mind MapSubscribe to unlock

An interactive map of every table and concept in this topic.

Table 1: Common Injection Attacks

Injection flaws all share one root cause—untrusted input getting interpreted as code or a query instead of as plain data. The entries here run from the classic SQL and cross-site scripting variants through to newer JavaScript-specific dangers like prototype pollution, but the defensive instinct is always the same: keep data and instructions strictly separated.

Vulnerability	Example	Description
SQL Injection	`SELECT * FROM users WHERE id = '` + userInput	• Attacker inserts malicious SQL via user input, potentially reading, modifying, or deleting database data • use parameterized queries
Cross-Site Scripting (XSS) - Stored	`<script>...</script>` saved to database	• Malicious script persists in the database and executes in every viewer's browser • most dangerous XSS variant
Cross-Site Scripting (XSS) - Reflected	`<script>alert(document.cookie)</script>` in URL param	Malicious script injected via request is immediately reflected in the response and executes in the victim's browser
Cross-Site Scripting (XSS) - DOM-based	`document.write(location.hash)`	• Vulnerability in client-side JavaScript processes untrusted data • payload never reaches the server
Command Injection	`system("ping " + userInput)`	Attacker executes arbitrary OS commands by injecting shell metacharacters into application inputs
Server-Side Request Forgery (SSRF)	`fetch("http://169.254.169.254/metadata")`	Tricks server into making requests to internal resources or cloud metadata endpoints, exposing credentials
XML External Entity (XXE)	`<!ENTITY xxe SYSTEM "file:///etc/passwd">`	Exploits XML parsers that process external entity references, enabling file disclosure, SSRF, or DoS
Template Injection	`{{7*7}}` in template input	Injects code into server-side template engine syntax (Jinja2, Freemarker), leading to remote code execution
NoSQL Injection	`{"user": "admin", "password": {"$ne": ""}}`	Manipulates NoSQL queries (MongoDB, etc.) using query operators to bypass authentication or extract data
Prototype Pollution	`user[__proto__][isAdmin]=true`	Attacker injects properties into JavaScript object prototypes via user-controlled input, affecting all objects app-wide
LDAP Injection	`(uid=` + user + `)`	Manipulates LDAP queries to access unauthorized directory information or bypass authentication

Table 2: Authentication and Authorization

Authentication proves who a user is; authorization decides what they may do. These rows cover both halves—from MFA, passkeys, and the OAuth/OIDC token stack that verify identity, to the RBAC and ABAC models that gate access once identity is established.

Technique	Example	Description
Multi-Factor Authentication (MFA)	Password + TOTP authenticator app	• Requires two or more verification factors (knowledge, possession, inherence) • significantly reduces account takeover risk

The rest of this section is part of the full cheat sheet

Table 3: Input Validation and Sanitization

Never trust what comes in, and encode carefully what goes out. The techniques here split into validating input at the boundary—allowlists, type and length checks, regex—and neutralizing it on the way to a sink with the right contextual encoding, the one-two combination that shuts down most injection attacks.

Technique	Example	Description
Whitelist Validation	`if input in ['admin', 'user']: accept`	• Accept only known-good values from a predefined list • most secure validation approach

The rest of this section is part of the full cheat sheet

Table 4: Session Management

Once a user logs in, the session token becomes the keys to their account—so the whole game is making that token hard to steal, hard to guess, and short-lived. These controls cover how the cookie is flagged, how the identifier is generated and rotated, and where the session state actually lives.

Technique	Example	Description
HTTP-only Cookies	`Set-Cookie: session=abc; HttpOnly`	• Prevents JavaScript from accessing the cookie via `document.cookie` • mitigates XSS-based session theft

The rest of this section is part of the full cheat sheet

Table 1: Common Injection Attacks

Vulnerability	Example	Description
SQL Injection	`SELECT * FROM users WHERE id = '` + userInput	• Attacker inserts malicious SQL via user input, potentially reading, modifying, or deleting database data • use parameterized queries
Cross-Site Scripting (XSS) - Stored	`<script>...</script>` saved to database	• Malicious script persists in the database and executes in every viewer's browser • most dangerous XSS variant
Cross-Site Scripting (XSS) - Reflected	`<script>alert(document.cookie)</script>` in URL param	Malicious script injected via request is immediately reflected in the response and executes in the victim's browser
Cross-Site Scripting (XSS) - DOM-based	`document.write(location.hash)`	• Vulnerability in client-side JavaScript processes untrusted data • payload never reaches the server
Command Injection	`system("ping " + userInput)`	Attacker executes arbitrary OS commands by injecting shell metacharacters into application inputs
Server-Side Request Forgery (SSRF)	`fetch("http://169.254.169.254/metadata")`	Tricks server into making requests to internal resources or cloud metadata endpoints, exposing credentials
XML External Entity (XXE)	`<!ENTITY xxe SYSTEM "file:///etc/passwd">`	Exploits XML parsers that process external entity references, enabling file disclosure, SSRF, or DoS
Template Injection	`{{7*7}}` in template input	Injects code into server-side template engine syntax (Jinja2, Freemarker), leading to remote code execution
NoSQL Injection	`{"user": "admin", "password": {"$ne": ""}}`	Manipulates NoSQL queries (MongoDB, etc.) using query operators to bypass authentication or extract data
Prototype Pollution	`user[__proto__][isAdmin]=true`	Attacker injects properties into JavaScript object prototypes via user-controlled input, affecting all objects app-wide
LDAP Injection	`(uid=` + user + `)`	Manipulates LDAP queries to access unauthorized directory information or bypass authentication

Table 2: Authentication and Authorization

Technique	Example	Description
Multi-Factor Authentication (MFA)	Password + TOTP authenticator app	• Requires two or more verification factors (knowledge, possession, inherence) • significantly reduces account takeover risk

Table 3: Input Validation and Sanitization

Technique	Example	Description
Whitelist Validation	`if input in ['admin', 'user']: accept`	• Accept only known-good values from a predefined list • most secure validation approach

Table 4: Session Management

Technique	Example	Description
HTTP-only Cookies	`Set-Cookie: session=abc; HttpOnly`	• Prevents JavaScript from accessing the cookie via `document.cookie` • mitigates XSS-based session theft