Tutorial 1: Injection, XSS, CSRF, and Authorization
Unit 6 · Security and privacy
Objectives
Identify common web attack surfaces.
Separate authentication from authorization.
Apply context-appropriate validation and output encoding.
Authentication answers who a user is; authorization answers what that user may do. Treat browser input, cookies, headers, uploaded files, and database values as untrusted until validated for their intended context.
// Safe principle: keep data separate from markup and queries.
const safeText = document.createTextNode(userInput);
// Server: use a parameterized query, not string concatenation.
SQL injection is prevented with parameterized queries. Cross-site scripting (XSS) is reduced by context-aware output encoding and safe DOM APIs. CSRF defenses use same-site cookies, anti-CSRF tokens, and appropriate method design. HTTPS protects data in transit but does not replace authorization.
Exercises
Threat-model a profile-edit endpoint.
Identify trust boundaries in a browser-to-database request.
Write authorization rules for student and administrator roles.
Self-check
What is the difference between authentication and authorization?
Why is HTTPS alone insufficient?
Why encode output for its context?
Self-Check Quiz
1. Which defense separates SQL structure from user data?
AnswerParameterized or prepared statements.
2. Who should enforce authorization?
AnswerThe server must enforce it; hiding a client-side control is not security.
Homework
Produce a threat model for a course-registration feature.
Specify defenses for injection, XSS, CSRF, session theft, and unauthorized access.
Review your design for unnecessary personal data collection.
Sample answerA strong answer identifies assets, actors, trust boundaries, and abuse cases. It uses prepared SQL, output encoding, secure same-site cookies, CSRF protection for state-changing requests, server-side role checks, HTTPS, rate limits, and data minimization.