TodayTools

Web security and OWASP flashcards

Keep your site and its users safe from the most common attacks.

Donate
Beginner friendly, starts from zero
Section
How to study
0
Web security and OWASPStart from zero · 1 of 12

What is web security, in one plain sentence?

Web security is keeping a website and its users safe from people who try to steal data, take over accounts or break things.

Locks, guards and good habits for a website.

All topics

Web security and OWASP at a glance

Web security keeps websites and their users safe from data theft, account takeover and damage.

Like running a building: lock the doors, check each visitor, limit which rooms they enter, and never obey a stranger's note.

Words you will meet

Input
Anything a user types, picks or sends to the site
Server
The computer that runs the website and answers requests
Script
A short piece of JavaScript that runs in the page
Query
A question sent to a database, written in SQL
Authentication
Proving who you are
Authorisation
Deciding what you may see or do
Hash
A one-way scramble used to store passwords
Phishing
A fake site or message that tricks you into giving a password

The steps

  1. 1. Start from zero (12 cards): What web security protects, where you see it, and the plain words attacks are described in.
  2. 2. Core basics (15 cards): The attacks behind most breaches, XSS and SQL injection, and how logins and passwords should work.
  3. 3. Next steps (16 cards): OWASP Top 10, access control, CSRF, cookies, CORS, CSP and the headers every site should send.
  4. 4. Go deeper (17 cards): SSRF, tokens, deserialisation, injection variants, secrets, threat modelling and finding bugs at scale.
All 12 cards in Start from zero
What is web security, in one plain sentence?
Web security is keeping a website and its users safe from people who try to steal data, take over accounts or break things.
What problem does it solve?
Websites hold passwords, money and private messages for millions of people. One small mistake can leak all of it at once, so builders must close the gaps before someone finds them.
Where do you already meet web security in daily life?
The padlock next to a web address, the code sent to your phone when you log in, a 'new sign-in' email, and password rules on sign-up forms.
What everyday thing is web security like?
Running a building: lock the doors, check who each visitor is, check which rooms they may enter, and never follow a note just because a stranger slipped it under the door.
What are a browser, a server, a request and a client?
Your browser (the client) sends requests to a server, the computer that runs the website, and the server answers. The person using the browser can change anything it sends.
What are HTML, JavaScript, a script and input?
HTML builds the page and JavaScript makes it act; a short piece of JavaScript is called a script. Input is anything a user types, picks or sends, and it must never be treated as code.
Your first tiny win: what does this database query do?
A database stores records in tables, and SQL is the language to ask it things. This query says: get the name from the users table where the email matches.
What are authentication, authorisation, a session and a cookie?
Authentication proves who you are, and authorisation decides what you may see or do. A session keeps you logged in, using a cookie: a small note the browser stores and sends back each time.
What are encryption, HTTPS and hashing?
Encryption scrambles data so only the right side can read it, and HTTPS is the web with encryption, shown by the padlock. Hashing is a one-way scramble used to store passwords: easy to make, impossible to undo.
What are an attacker, a vulnerability, a breach and phishing?
An attacker is someone trying to misuse a site, and a vulnerability is a weak spot they can use. A breach is when data actually leaks, and phishing is a fake site or message that tricks you into giving away a password.
What do you need before you start?
Just a browser, nothing to install. Its DevTools panel (press F12) shows every request a page sends, and curl is a terminal command that sends requests without a browser.
What will you be able to do after this topic?
Spot the most common web attacks, show user text safely, write database queries input cannot change, store passwords properly, check who may see what, and handle leaked keys.
Web security and OWASP cheatsheet

Security headers

  • Content-Security-Policy: script-src 'nonce-x' 'strict-dynamic' Only trusted scripts run
  • Strict-Transport-Security: max-age=63072000; includeSubDomains HTTPS only, 2 years
  • X-Content-Type-Options: nosniff No MIME guessing
  • Referrer-Policy: strict-origin-when-cross-origin Do not leak full URLs
  • Content-Security-Policy: frame-ancestors 'none' Block clickjacking
  • Permissions-Policy: camera=(), geolocation=() Disable unused features
  • Cross-Origin-Opener-Policy: same-origin Isolate from popups

Cookie flags

  • HttpOnly Not readable by JavaScript
  • Secure HTTPS only
  • SameSite=Lax No cross-site POSTs
  • SameSite=Strict Never cross-site
  • __Host-name Secure, Path=/, no Domain
  • Max-Age=3600 Expire in an hour
  • Partitioned Per-site third-party cookie (CHIPS)

Attack and fix

  • XSS Escape output, strict CSP, sanitise HTML
  • SQL injection Parameterised queries
  • CSRF SameSite, token, Origin check
  • IDOR Scope every lookup to the owner
  • SSRF Allow-list hosts, block private IPs
  • Command injection execFile with an argument array
  • Path traversal Resolve and check base directory
  • Mass assignment Allow-list fields with a schema

OWASP Top 10:2025

  • A01 Broken Access Control (incl. SSRF)
  • A02 Security Misconfiguration
  • A03 Software Supply Chain Failures
  • A04 Cryptographic Failures
  • A05 Injection
  • A06 Insecure Design
  • A07 Authentication Failures
  • A08 Software or Data Integrity Failures
  • A09 Security Logging and Alerting Failures
  • A10 Mishandling of Exceptional Conditions

Crypto choices

  • Argon2id (m=19 MiB, t=2) Password hashing
  • bcrypt cost 12 Password hashing, 72-byte limit
  • AES-256-GCM Encrypt data at rest
  • HMAC-SHA256 Sign webhooks and tokens
  • crypto.randomBytes(32) Tokens and reset links
  • TLS 1.3 Data in transit
  • MD5, SHA-1, ECB Never for security
Donate