Skip to content

Web & API security

Web and API security: the OWASP map, XSS and CSP, CSRF, SQL injection, broken object-level authorization, SSRF, secrets and the supply chain.

8 lessons

Threat map

  1. 1The threat map: OWASP Top 10:2025, API Security Top 10:2023 and baseline headersName the class first; most of the top classes are logic a scanner cannot see.

Browser-side attacks

  1. 2XSS and Content Security PolicyUntrusted data becomes code when it reaches a sink in your origin; encode for the context, sanitize before the sink, nonce-lock scripts with CSP.
  2. 3CSRF and SameSite: why a cookie is not consentA cookie proves who is signed in; only a token or the browser's own headers prove your page sent the request.

Server-side attacks

  1. 4SQL injection with ORMs and raw queriesValues travel apart from the SQL; names and keywords come from your own list.
  2. 5Broken object-level authorization: whose record is this?The user is allowed on the endpoint; the violation is at the object, so tie every lookup to its owner.
  3. 6Server-side request forgery (SSRF)A server that fetches a user's URL must judge the address it connects to, not the URL text: resolve, refuse non-public ranges, re-check redirects.

Secrets and supply chain

  1. 7Secrets management: storage, injection, rotation, leakageStore it, inject it at start, ship it nowhere, and revoke it first when it leaks.
  2. 8Software supply chain: dependencies, install scripts, lockfilesAn install runs strangers' code as you: fix the versions, approve the scripts, and leave the install step nothing to take.