Security

This section covers application-level security — the controls that live in the code of a web service rather than in the platform around it. Three topics have pages of their own: the browser mechanisms people routinely confuse with one another, the coding practices that keep a Java or Spring service from handing an attacker more than it should, and the handling of database credentials.

Controls at the data and infrastructure layer — encryption in transit and at rest, key management, access control and data minimisation — are covered under Cloud Data Security Principles.

• CSRF, XSS and CORS — what each term means, which of them is an attack, and which is a relaxation rather than a defence.
• Secure coding — output encoding, error pages, logging, deserialization and dependency hygiene.
• Database credentials — getting connection details into a process without committing or logging them.