Web Application Security
Overview
Web Applications are the dominate form of how most of us interact with data. From the early days of the world-wide-web where it was a read-only view of data we have evolved to highly dynamic 2-way real-time views of everything we hold dear.
Securing a web application is complex owing to the many risks. And, it is certainly an area many sites can improve.
Content-Security-Policy protects our application, but challenging with external scripts like Google Tag Manager. We show in Angular Single Page Application.
Certificate Transparency Logs in SSL can be a useful diagnostic tool as well as a security forensic.
The OAuth 2.0 protected resource. It takes the access token and uses it to grant access. Watch out for it becoming compromised.
OAuth 2.0 refresh tokens are used to obtain new access tokens on the user’s behalf. If lost, they can allow an attacker to masquerade.
The OAuth 2.0 Token Endpoint. Its were authorisation becomes real. Secure it to prevent guessing
OAuth 2.0 Authorisation Endpoints are the front-door skeleton-key creator of all your front-doors. So protect them carefully.