Knowledge Pillar
Web Security Basics
Essential web security fundamentals for engineers: HTTPS transport encryption, resilient authentication, REST API hardening, session lifecycle, and defensive input validation.
Pillar Overview & Core Principles
Web application security begins with fundamental engineering primitives. Before addressing complex distributed threats, engineering teams must establish resilient defenses at the foundational layers of their technology stack. This knowledge hub provides comprehensive, battle-tested guides covering modern Transport Layer Security (TLS 1.3), memory-hard password hashing (Argon2id) and FIDO2 Passkeys, REST API authorization architecture (defending against BOLA/IDOR), cryptographically hardened session cookies (`__Host-` prefixes), and schema-based defensive input validation. Every guide combines low-level protocol mechanics with production TypeScript and server configurations.
Web Security Engineering Foundations Path
A progressive technical path designed to teach software engineers how to architect secure web applications from the network layer up to the application business logic.
Transport Layer Encryption
Deploy TLS 1.3, configure automated certificate lifecycles, and enforce HTTPS to secure data in transit.
Identity & Authentication Architecture
Implement memory-hard password hashing with Argon2id, rate limiting, TOTP MFA, and FIDO2 Passkeys.
REST API Security Architecture
Neutralize BOLA/IDOR vulnerabilities, harden asymmetric JWTs, and deploy Redis sliding window rate limiters.
Stateful Session Lifecycle
Architect tamper-proof sessions with CSPRNG entropy, SameSite cookies, and `__Host-` prefixes.
Defensive Input Validation
Enforce strict schema allowlisting with Zod, neutralize ReDoS vulnerabilities, and sanitize file uploads.
Foundational Standards & Specifications
Every technical guide in this pillar is grounded in officially recognized specifications, regulatory standards, and peer-reviewed testing methodologies.
NIST SP 800-63B (Digital Identity Guidelines)
NIST (National Institute of Standards and Technology)Authoritative US federal guidelines for password entropy, memory-hard hashing, MFA requirements, and passkey authentication.
OWASP ASVS (Application Security Verification Standard)
OWASPA framework of security requirements and controls for testing web application technical security architecture.
IETF RFC 8446 (Transport Layer Security 1.3)
IETFStandardized specification for modern internet transport encryption with forward secrecy and reduced handshake latency.
IETF RFC 6265bis (Cookies: HTTP State Management)
IETFUpdated internet draft specifying secure cookie attributes, including SameSite, HttpOnly, and __Host- prefixes.
All Web Security Basics Guides (5)
Curated by Wescequre ResearchHTTPS · SSL
Why HTTPS Matters: Security, SEO & User Trust
Technical guide to HTTPS: cryptographic foundations of TLS 1.3, packet sniffing prevention, HTTP/2 multiplexing performance, and automated Let's Encrypt deployment.
authentication · passwords
Secure Authentication Architecture: Passwords, MFA & Passkeys
Developer blueprint for authentication architecture: Argon2id password hashing parameters, FIDO2/WebAuthn passkey implementation, and credential stuffing defense.
API security · REST
REST API Security Best Practices for Modern Applications
Developer blueprint for securing REST APIs: BOLA/IDOR prevention patterns, asymmetric JWT validation, Redis token bucket rate limiting, and strict input DTOs.
sessions · cookies
Secure Session Management: Cookies, Tokens & Best Practices
Technical guide to session security: cryptographically secure cookie prefixes (`__Host-`), session fixation defense, idle timeouts, and Redis session architectures.
input validation · sanitization
Input Validation & Sanitization: Defensive Programming Guide
Developer blueprint for input validation: schema-based allowlists with Zod, ReDoS catastrophic backtracking defense, and safe multipart file upload pipelines.
Wescequre Platform · Surface Monitor
Application Attack Surface Analyzer
Inspect open ports, TLS certificate chains, HTTP headers, and API endpoint security posture.
Includes: TLS/SSL cipher suite & expiration monitoring · Security header verification (CSP, HSTS) · Subdomain asset discovery
Frequently Asked Questions
Defense-in-depth is the architectural practice of layering redundant, independent defensive controls throughout every layer of an application. If an attacker successfully bypasses an outer defense (such as client-side input validation), inner defensive layers (such as parameterized database queries, strict Content Security Policies, and least-privilege database user permissions) prevent complete system compromise.
Developing cryptographic algorithms requires advanced mathematical proof and years of global cryptanalysis. In-house implementations inevitably suffer from subtle mathematical flaws, side-channel timing leaks, predictable pseudo-random seeds, and CPU instruction vulnerabilities. Engineers must always rely on peer-reviewed, industry-standard primitives (e.g., Argon2id, AES-256-GCM, Ed25519) implemented by audited libraries like libsodium or Node's native Web Crypto API.
No. HTTPS only provides transport layer encryption to prevent network eavesdropping and tampering between the client and server. It provides zero protection against application-layer vulnerabilities such as Broken Object Level Authorization (BOLA), parameter tampering, SQL injection, credential stuffing, or business logic flaws.
Authentication (AuthN) is the process of verifying WHO a user or entity is (e.g., verifying a password, TOTP token, or passkey signature). Authorization (AuthZ) is the process of determining WHAT an authenticated entity is permitted to access or execute (e.g., verifying whether User A has permission to read invoice #4820). Most security breaches in modern web apps occur at the authorization layer.