TRACE
Web security
A compact guide to learning web application security. Use the concepts in deliberately vulnerable labs or systems you are explicitly authorized to test.
Core principles
| Concept | What to understand |
|---|---|
| Authentication | How a system establishes who a user is. |
| Authorization | Which actions and data an authenticated user is allowed to access. |
| Least privilege | Give each account, service and process only the access it needs. |
| Input validation | Check data against the expected format and constraints at the trust boundary. |
| Output encoding | Represent untrusted data safely for the context where it is displayed. |
| Defense in depth | Use multiple complementary controls rather than relying on one safeguard. |
A safe review workflow
Before any test, identify the owner, written authorization, exact scope, allowed methods, time window and reporting channel. If any of these are unclear, pause and ask.
1. Read the scope and rules2. Use a dedicated training environment or approved account3. Make one small, reversible observation at a time4. Avoid real user data and disruptive actions5. Record only the minimum evidence needed6. Report privately through the approved channel
This checklist supports careful learning; it does not grant permission to test any system.
Defensive questions
| Area | Review question |
|---|---|
| Access control | Is access checked on the server for every requested object and action? |
| Sessions | Are session identifiers protected and invalidated when no longer needed? |
| Errors | Do failures avoid exposing secrets, stack traces or internal details? |
| Dependencies | Are components inventoried, updated and monitored for known issues? |
| Logging | Are security-relevant events recorded without logging passwords or tokens? |
More traces
Questions
Where can web security be practised safely?
Use purpose-built environments such as PortSwigger Web Security Academy, OWASP Juice Shop or another lab that explicitly allows testing.
Can any website be tested?
Only with explicit authorization and when the activity is within the published scope. Otherwise, do not test it.
What is the OWASP Top 10?
It is an awareness document describing important categories of web application security risk. It is a learning aid, not a complete testing checklist.