Web Security
OWASP risks, XSS, CSRF, CORS and secure design.
All topics · 3 lessons · 26 resources
Learn Web Security on System Design Atlas
- 01Web attacks: XSS, CSRF, injection, SSRF and clickjackingHow each major web attack works in plain terms and the few defences that stop most of them.Networking and Web Security Deep Dive · 14 min read · start here
- 02JWT, cookies, CORS and security headersTokens and the browser's rules: what is inside a JWT, where to store tokens, what CORS really controls and the headers worth sending.Networking and Web Security Deep Dive · 13 min read
- 03The OWASP Top 10 and secure designA map of the most common web application risks, what each means in practice and a short review checklist you can apply to any design.Networking and Web Security Deep Dive · 13 min read
Related topics
These share a lesson with Web Security.
Curated Web Security resources
Books
- Security EngineeringHow to build systems that stay secure when things go wrong: threat models, protocols, access control and failures. The author publishes the book free online.University of Cambridge
- Building Secure and Reliable SystemsDesigning, implementing and operating systems that are both secure and reliable.O'Reilly / Google
Case Studies
- Active Directory Password Blacklisting at YelpActive Directory Password Blacklisting Leeren Chang, Software Engineer Apr 16, 2018 Many enterprise professionals use passwords that are weak and easily compromised. Equipped with this knowledge, as well as the...Yelp
- Athenz: Fine-Grained, Role-Based Access Control at Yahooyahoocs: By Lee Boynton, Henry Avetisyan, Ken Fox, Itsik Figenblat, Mujib Wahab, Gurpreet Kaur, Usha Parsa, and Preeti Somal Today, we are pleased to offer Athenz, an open-source platform for fine-grained access control, to the community. Athenz is a role-based access control (RBAC) solution, providing trusted…Yahoo
- AVA: Audit Web Applications at IndeedVulnerabilities in your web applications could endanger your systems. Indeed Security developed AVA to automate scanning for common vulnerabilities.Indeed
- Clock Skew when Syncing Password Payloads at DrobboxHow Dropbox Passwords fixed sync errors from clock skew by replacing a two-way timestamp merge with a three-way merge against a base payload.Drobbox
- Distributed SecurityA real-world engineering write-up from Microsoft on distributed Security.Microsoft
- Enterprise Key Management at SlackOver the years, customers have asked us for stricter control over and visibility into their data in Slack, all while maintaining the product’s most essential features, such as link unfurling, mentions, notifications, and search. We talked with many of these customers to get a better understanding of their threat…Slack
- Hardening Kubernetes Infrastructure with Cilium at PalantirA real-world engineering write-up from Palantir on distributed Security.Palantir
- Improving Web Vulnerability Management through Automation at LyftVulnerability management can be tremendously time consuming. Flyte provides a path to automation that both saves time and is easy to…Lyft
- OAuth Audit Toolbox at IndeedIntegrating third party apps with GSuite can be risky. Indeed's OAudit Toolbox allows you to educate your users and improve application security.Indeed
- Scalability and Authentication at TwitchCurious how Twitch Identity services address scalability and performance challenges related to authentication?Twitch
- Scalable IAM Architecture to Secure Access to 100 AWS Accounts at SegmentA real-world engineering write-up from Segment on distributed Security.Segment
- Scalable User Privacy at SpotifyAt Spotify, we have a complex and diverse data processing ecosystem. Our backend infrastructure handles millions of requests per second, which are processed by over a thousand (micro)services. Our batch pipeline environment is equally complex and diverse; we run thousands of jobs written in a variety of frameworks…Spotify
- Secure Infrastructure To Store Bitcoin In The Cloud at CoinbaseA real-world engineering write-up from Coinbase on distributed Security.Coinbase
- Security Development Lifecycle at SlackFor development teams, process can often be antithetical to speed. Ease of deployment and security tend to have an inverse relationship, with some resentment for the security team occasionally mixed in. You may have seen the following tweet: https://twitter.com/petecheslock/status/595617204273618944?lang=en We…Slack
- Syscall Auditing at Scale at SlackIf you are are an engineer whose organization uses Linux in production, I have two quick questions for you: 1) How many unique outbound TCP connections have your servers made in the past hour? 2) Which processes and users initiated each of those connections? If you can answer both of these questions, fantastic! You…Scale at Slack
- TTL as a Service: Automatic Revocation of Stale Privileges at YelpTTL as a Service: Automatic Revocation of Stale Privileges Aaron Loo, Engineering Manager Nov 19, 2018 Security and usability are often at odds with one another, a fact that is...Yelp
- Unprivileged Container Builds at KinvolkWhy `docker build` normally needs root, and how Linux user namespaces and mount restrictions could allow unprivileged container builds.Kinvolk
Blogs
- AWS Security BlogAmazon GuardDuty Extended Threat Detection correlates weak GuardDuty signals into a single, critical-severity attack sequence finding when their composition crosses a threshold of credibility. On May 20, 2026, the service started attaching five new indicator types to those sequences: MALICIOUS_PACKAGE,…Amazon Web Services
- Google Security BlogGoogle's security blog: news and updates on security topics, such as new Android protections.Google
Documentation
- Introduction to JSON Web TokensWhat a JWT contains and how it is signed and verified.jwt.io
- MDN: Cross-Origin Resource Sharing (CORS)The clearest reference for how the browser's cross-origin rules and preflight requests work.Mozilla
- OWASP Cheat Sheet SeriesShort, practical guides for defending against each class of web vulnerability.OWASP Foundation
- OWASP Top 10The standard awareness list of the most critical web application security risks.OWASP Foundation
- RFC 6749: The OAuth 2.0 Authorization FrameworkThe standard defining OAuth 2.0 roles and flows.IETF