DEFINITION 01
API Security
API security protects application interfaces, their data, and operations from unauthorized use and abuse.
The CyberGuard field guide / Topics
Web Application Security.
Explore the controls and common flaws affecting websites, APIs, and browser sessions.
17 published definitionsPractical examples and source links
← Back to the dictionary
THE DEFINITIONS
Explore Web Application Security.
Open a term for a plain-language explanation, a technical explanation, and a practical example.
DEFINITION 02
Authentication Bypass
Authentication bypass is a flaw that lets someone reach a protected function without completing the required identity check.
DEFINITION 03
Broken Access Control
Broken access control is a failure to enforce which resources or actions an authenticated or anonymous user is allowed to use.
DEFINITION 04
CORS
Cross-Origin Resource Sharing (CORS) is a browser mechanism that lets a server state which other origins may read its responses.
DEFINITION 05
Clickjacking
Clickjacking tricks a person into clicking a hidden or disguised interface element, often by placing a target page inside a frame.
DEFINITION 06
Content Security Policy
A browser policy that restricts which resources and scripts a web page may load or execute.
DEFINITION 07
Cross Site Request Forgery
Cross-site request forgery (CSRF) causes a signed-in browser to send an unwanted state-changing request to another site.
DEFINITION 08
Cross-Site Scripting
Injection of malicious script into content that another user’s browser executes.
DEFINITION 09
Dependency Confusion
Dependency confusion is a software supply chain attack in which a build resolves an unintended public package in place of an expected private package.
DEFINITION 10
Deserialization Vulnerability
A deserialization vulnerability occurs when an application unsafely reconstructs data or objects from untrusted input.
DEFINITION 11
HTTP Security Headers
HTTP security headers are response fields that tell browsers how to apply selected protections when handling a page.
DEFINITION 12
Insecure Direct Object Reference
An insecure direct object reference (IDOR) exposes an object through a user-controlled identifier without checking the caller's permission for that object.
DEFINITION 13
Open Redirect
An open redirect lets an attacker choose an untrusted destination for a link or redirect served by a legitimate site.
DEFINITION 14
SQL Injection
Injection of untrusted input into a database query so it changes the intended query behavior.
DEFINITION 15
Same Origin Policy
The same-origin policy is a browser rule that limits how scripts from one origin interact with content from another origin.
DEFINITION 16
Server-Side Request Forgery
A flaw that lets an attacker induce a server to send a request to an unintended destination.
DEFINITION 17
Session Hijacking
Session hijacking is the unauthorized use of another person's active session, often through a stolen or exposed session identifier.
KEEP EXPLORING
Follow another topic.
Build context across the connected parts of cybersecurity.
Browse all other topics
Network Security 22Malware 18AI Security 15Business Cybersecurity 15Incident Response 15Cloud Security 14Core Cybersecurity 6Cryptography 4Identity Access 4Phishing Social Engineering 4Vulnerability Management 4Fraud Online Safety 3Privacy Data Protection 2Security Technologies 2Threat Intelligence 2Endpoint Security 1Ethical Hacking 1Governance Risk Compliance 1Wireless Mobile Security 1