Web Development · Advanced level

Advanced level · Module 2: Authentication and Web Security · Lesson 3 of 4

Common Web Attacks and Defences

Recognise the most common web vulnerabilities and apply the standard defences.

In this lesson you will

  • Explain XSS, CSRF, injection and broken access control
  • Apply defences for each in an Express and React application

Key concepts

OWASP Top 10XSSCSRFbroken access control

The lesson

The OWASP Top 10 lists the most critical web application risks. Broken access control (users reaching other users' data), injection and security misconfiguration appear in almost every real-world review.

Cross-site scripting (XSS) injects scripts through unescaped user data; React escapes text by default, so avoid dangerouslySetInnerHTML with untrusted content. Cross-site request forgery (CSRF) tricks a logged-in browser into sending requests; SameSite cookies and CSRF tokens prevent it.

Check object ownership on every request: GET /bookings/42 must verify that booking 42 belongs to the requesting customer, not just that someone is logged in.

Step by step

  1. Review the booking platform against an OWASP-based checklist.
  2. Try to view another customer's booking by changing an ID.
  3. Fix the access-control check.
  4. Check for unsafe HTML rendering and CSRF protection.

Practice activity

Run the security review from the practical activity and fix every finding.

Expected result: A review report with each finding, its fix and a test or demonstration proving it.

Check your understanding

  1. What is broken access control?

    Show answer

    Users can access data or actions they should not, such as other users' records.

  2. How does React help against XSS?

    Show answer

    It escapes text content by default when rendering.

Taught live by an instructor — online or in person. Free course lessons are for self-study and do not lead to a certificate — see registration options.