What is architecture
High-level design of components and their interaction. Draw as building blocks (paper/whiteboard)
What is implementation?
Made concrete with languages, tools and frameworks. Consider practical low-level details (security, scalability etc)
Vulnerabilities due to poor architecture
- Lack of encryption
- Vulnerable to DoS
- Race condition
- Unintended access
Vulnerabilities due to poor implementation
- Buffer overflow
- Unvalidated input
- Code injection
Difference between vulnerability fixes for architecture and implementation
Architecture - mostly unfixable, requires rebuild
Implementation - mostly fixable depending on language + off-shelf components
Web Application Architecture
- User communicates with web server via HTTP
- Web server serves HTML and runs server-side scripting
- Database runs SQL
- Web server communicates with other services via HTTP
HTML
Defines structure and display. Actual page content
HTTP
Protocol for exchanging info (independent of page design)
Web server requests
TCP/IP
Handles connectivity (ports)
What does PHP do?
Generates dynamic pages. Input is processed and output as pure HTML. It runs on the server and the browser only sees HTML.
What are HTTP Headers?
Key-value pairs sent with HTTP requests and responses, providing metadata about the message. Enable structured, efficient, and secure web communication between server and client.
Content-Security-Policy (CSP)
allows you to restrict which resources (such as JavaScript, CSS, Images etc.) can be loaded, prevents xss
X-Frame-Options
Defines whether the browser should allow iframes, mitigates clickjacking
Referrer-Policy
Controls privacy, controls the amount of referrer information sent w/in subsequent request
Strict-Transport-Security (HSTS)
Defines whether browser requests HTTPS only
Cross-Origin Resource Sharing (CORS)
From the server, a website loads different elements from different origins. This defines which domains the browser can accept resources from
Why are cookies needed?
HTTP is stateless, each client-server request-response cycle is independent, server does not retain any information about past interactions. Cookies track sessions
Cookies
Files that store information about your session. Created by Netscape as way to store items in shopping carts.
Session cookies
Temporary text files stored on device by websites during visit, enabling site to remember information like login status or items in shopping cart
Persistent cookies
Long-term tracking. Last forever until deleted or the expiration date. Store information like user preferences.
First-Party Cookies
set/read by the visited site
Third-party cookies
Cookies set by a domain different from the one you are directly visiting, e.g., advertisers, analytics services. Enable tracking across sites. (Being phased out)
Cookie Risks
Session hijacking. Cookie is intercepted and stolen, leading to impersonation.
Cookie Attributes
Secure, HttpOnly, SameSite, expiry, domain
