Before Web Security 2
by Froga
The ideas the Web security 2 lab assumes: what a signed token is, how a database query is built from parts, why a server fetching a URL for you is different from you fetching it, and the theme under all of it — the server must not trust data just because it handled it. About ten minutes.
You're previewing this room. Log in or create a free account to answer the questions and track your progress.
Study material
Lab one lived near the surface: a page that showed too much, a URL or cookie that let you ask for the wrong thing. The fixes were all "check on the server". This lab is about the server checking — and still trusting something it should not: a token, an object, a URL, a string. Knowing that shift is the whole frame.
The first web lab was mostly about what the page shows you; this one is about what the server itself trusts.
true false
True
False
Ready to test yourself?
Sign up free to answer, score points, and build your streak.