Web security Part-2 #38

 

SSL

Secure socket layer (SSL), an encrypt based internet security protocol, it was founded for the ensuring of the integrity and privacy of the connection of the internet by the Netscape company at 1995, nowadays it names TLS.

How it works

It like the new TLS based on the concept of the handshake TLS.

 

Cors

Cross origin resources sharing (CORS) is a mechanism that uses HTTP headers to specify which outer origin have access to the local assets and how can access it that is mean we can make a white list for the allowed cross origins that has access to our assets the server must have a way to handle the outer requests and this what we will discuss now.

How it Works

When the site makes a get request to get resources from the out server, the browser adds a header that contains the origin like the example origin:

http://www.developersdj.com

the server receives the pre-flight request and searches in its whites list for access control allow origins about the giving origin and sends to the browser option call, then the browser will determine if the actual request is safe to send or not example access control allow origin http://www.developersdj.com or this header access control allow origin * will allow any request to take the resource.

If the server specific the methods it will compare the request method with its example access control allow methods: PUT, DELETE

 

CSP

Content security policy is more security layer that helps in detect and mitigate different sort of militias attacks like (cross site scripting(XSS), data injection attacks, Clickjacking, Etc.)

Cross site scripting (XSS)

It a vulnerability that allows the hacker to inject a militias code in the base website and it is for making the client executes it to take sensitive data like cookies, session’s info and site specification information, that happens because web app does not use enough validation or encoding, the user’s browser cannot detect the malicious script is untrustworthy.

Data injection attacks

Is a malicious code injected in the network which fetched all the information from the database to the attacker and the number one type of it is the SQL injection?

Click jacking

Or “UI redress attack” is when an attacker tricks a user into clicking on a button or link on another page that uses multiple transparent or opaque layer when he intended to click on the top level

 How it Work

It uses directives concepts that’s every directive has to specify where resources can load from, preventing browsers from loading data from any other locations