authors are vetted experts in their fields and write on topics in which they have demonstrated experience. All of our content is peer reviewed and validated by Toptal experts in the same field.
Gergely Kalman's profile image

Gergely Kalman

Gergely has worked as lead developer for an Alexa Top 50 website that serves several million unique visitors each month.

Expertise

CybersecuritySystem Security

Previously At

Universal Music Group
Share

Editor’s note: This article was updated on 08/12/2022 by our editorial team. It has been modified to include recent sources and to align with our current editorial standards.

For all too many companies, it’s not until after a security breach has occurred that web security best practices become a priority. During my years working as an IT security professional, I saw—time and time again—how obscure the world of web development security issues can be to so many of my fellow programmers and how many website vulnerabilities go unnoticed.

An effective approach to web security threats must, by definition, be proactive and defensive. Toward that end, we aim to spark a security mindset and to inject the reader with a healthy dose of paranoia.

In particular, this guide focuses on developing an awareness of and mitigating 10 common and significant web security pitfalls, ranging from common vulnerabilities in web applications to browser vulnerabilities.

An example of some common web vulnerabilities no one wants to face.

Authentication and Authorization: A Cyber Security Primer

Programmers and IT professionals often express confusion regarding the distinction between authorization and authentication. The use of the abbreviation auth for both terms increases the haziness that surrounds them.

Let’s define and clarify the distinction:

  • Authentication: Verifying that a user is (or at least appears to be) the person they say they are.
  • Authorization: Granting a user access to a specific resource, or permission to perform a particular action.

Stated another way, authentication is knowing who an entity is, while authorization is what a given entity can do. With this in mind, let’s explore 10 common internet vulnerability issues.

Injection Flaws

Injection flaws result from a classic failure to filter untrusted input. Injection flaws can happen when we pass unfiltered data to the SQL server (SQL injection), to the browser (via Cross Site Scripting), to the LDAP server (LDAP injection), or anywhere else. The problem here is that the attacker can inject commands to hijack clients’ browsers, resulting in loss of data.

Anything that your application receives from an untrusted source must be filtered, preferably according to a whitelist. Using a blacklist to this end is not recommended, as it is difficult to configure properly. A blacklist is also considered easy for a hacker to bypass. Antivirus software products typically provide stellar examples of failing blacklists. Pattern matching does not work.

Prevention: Protecting against injection is “simply” a matter of filtering our input and considering which senders can be trusted. Filtering is quite an undertaking because we need to process all input unless it can unquestionably be trusted.

If we filter 999 inputs in a system with 1,000 inputs, we still have one field that can be the Achilles’ heel that brings down our system.

Using Second Order SQL Injection to inject one SQL query result into another is also considered dangerous. It could seem like a good idea because the database is trusted. But if the perimeter is not, our input could originate indirectly from a malicious source.

Since filtering is pretty hard to get right, it is advisable to rely on our framework’s filtering functions. They are proven to work and thoroughly scrutinized. If you do not already use a framework, consider the server security benefits of moving to one. .

Broken Authentication

Problems that might occur during broken authentication don’t necessarily stem from the same root cause. Rolling your own authentication code is not recommended, as it is hard to get right. There are myriad possible pitfalls, and here are a few:

  1. The URL might contain the session ID and leak it in the referer header.
  2. Passwords might not be encrypted in storage and/or transit.
  3. Session IDs might be predictable, making it a little too easy to gain unauthorized access.
  4. Session fixation might be possible.
  5. Session hijacking could occur if timeouts are not implemented correctly, or if using HTTP (no SSL security), etc.

Prevention: The most straightforward way to avoid the web security vulnerabilities related to broken authentication is to implement a framework. If you roll your own code, be extremely paranoid and educate yourself on web security considerations and the potential issues that could arise.

Cross-Site Scripting (XSS)

An attacker sends on input JavaScript tags to your web application. When this input is returned to the user unsanitized, the user’s browser would execute it. This is a fairly widespread input sanitization failure, essentially a subcategory of injection flaws). CSS can be as simple as crafting a link and persuading a user to click it, or it can be something much more sinister. For example, on page load, the script would run and be used to post your cookies to the attacker.

Prevention: Simply put, don’t return HTML tags to the client. This would also protect you from HTML injection, which is when an attacker injects plain HTML content (such as images or loud but invisible flash players). To implement this solution, convert all HTML entities to return something else. For example, convert