Back-end Web Developement Security Syllabus

Security syllabus — full chapter and topic list

Expand any chapter to see its topics and sub-topics. This is the whole examinable outline for Security in Back-end Web Developement, not a summary of it.

1. 1

   Authentication

   3 topics

   • JWT
   • OAuth
   • Single Sign-On (SSO)
2. 2

   Data Encryption

   2 topics

   • SSL/TLS
   • Hashing Algorithms
3. 3

   Vulnerabilities

   3 topics

   • SQL Injection
   • Cross-Site Scripting (XSS)
   • Cross-Site Request Forgery (CSRF)

Security flashcards for Back-end Web Developement

23 of 50 cards from the Security deck — real questions with worked answers.

1. What does JWT stand for, and what is it used for?

   JWT stands for JSON Web Token. It is a compact, URL-safe, self-contained token format (RFC 7519) used to securely transmit claims between parties, most commonly for stateless authentication and authorization.

2. What are the three parts of a JWT, and how are they separated?

   A JWT has three parts separated by dots ($.$): Header, Payload, and Signature — written as $\text{header}.\text{payload}.\text{signature}$. Each part is Base64URL-encoded.

3. What does the JWT Header contain?

   The Header contains metadata about the token, typically the token type ("typ": "JWT") and the signing algorithm ("alg", e.g. HS256 or RS256).

4. What does the JWT Payload contain?

   The Payload contains the claims — statements about an entity (usually the user) and additional data, such as registered claims (iss, sub, aud, exp, iat), public claims, and private claims.

5. List the common registered (standard) JWT claims and their meanings.

   iss (issuer), sub (subject), aud (audience), exp (expiration time), nbf (not before), iat (issued at), and jti (JWT ID).

6. How is the JWT signature computed for an HMAC (HS256) token?

   $$\text{signature} = \text{HMACSHA256}\big(\text{base64url}(header) + "." + \text{base64url}(payload),\ secret\big)$$ The signature verifies integrity and authenticity, not confidentiality.

7. Is the payload of a standard JWT encrypted? What does this imply for storing sensitive data?

   No. A standard (signed) JWT is only Base64URL-encoded, not encrypted, so anyone can read the payload. Never store sensitive data (passwords, secrets) in it unless you use JWE (JSON Web Encryption).

8. Compare symmetric (HS256) vs asymmetric (RS256) JWT signing.

   HS256 uses one shared secret for both signing and verifying (HMAC). RS256 uses a private key to sign and a public key to verify (RSA), so verifiers never need the signing secret — better for distributed systems.

9. What is OAuth 2.0, and what problem does it solve?

   OAuth 2.0 is an authorization framework (RFC 6749) that lets a third-party application obtain limited access to a user's resources on another service without exposing the user's credentials, via delegated access tokens.

10. Name the four roles defined in OAuth 2.0.

    Resource Owner (the user), Client (the app requesting access), Authorization Server (issues tokens), and Resource Server (hosts the protected resources).

11. Is OAuth 2.0 an authentication or an authorization protocol?

    OAuth 2.0 is fundamentally an authorization (delegated access) protocol. It is not designed for authentication; OpenID Connect (OIDC) is the layer built on top of OAuth 2.0 to provide authentication.

12. Describe the OAuth 2.0 Authorization Code flow at a high level.

    The client redirects the user to the authorization server; the user authenticates and consents; the server returns an authorization code to the client's redirect URI; the client exchanges that code (plus its client secret) at the token endpoint for an access token (and optionally a refresh token).

13. What is PKCE in OAuth 2.0 and why is it used?

    PKCE (Proof Key for Code Exchange, RFC 7636) secures the Authorization Code flow for public clients (e.g. mobile/SPA) by using a code_verifier and its hashed code_challenge, preventing authorization code interception attacks.

14. What is the difference between an OAuth access token and a refresh token?

    An access token is short-lived and used to access protected resources. A refresh token is longer-lived and used to obtain new access tokens without re-prompting the user for credentials.

15. What is OpenID Connect (OIDC) and how does it relate to OAuth 2.0?

    OIDC is an identity layer on top of OAuth 2.0 that adds authentication. It introduces the ID Token (a JWT containing user identity claims) alongside the access token.

16. What is Single Sign-On (SSO)?

    SSO is an authentication scheme that lets a user log in once with a single set of credentials and gain access to multiple independent applications or services without re-authenticating for each one.

17. Name two common protocols/standards used to implement SSO.

    SAML (Security Assertion Markup Language, XML-based) and OpenID Connect (OIDC, JSON/JWT-based, built on OAuth 2.0). Kerberos is another SSO protocol used in enterprise networks.

18. In SAML-based SSO, what are the Identity Provider (IdP) and Service Provider (SP)?

    The Identity Provider (IdP) authenticates the user and issues a SAML assertion. The Service Provider (SP) is the application the user wants to access and trusts the IdP's assertion to grant access.

19. What is a SAML assertion?

    A SAML assertion is an XML document issued by the IdP that contains statements about the authenticated user — authentication, attribute, and authorization decision statements — which the SP consumes to establish a session.

20. List one key advantage and one key risk of SSO.

    Advantage: fewer passwords to manage, improved user experience, and centralized access control. Risk: it is a single point of failure — if the SSO credentials or IdP are compromised, all connected applications are at risk.

21. What is the difference between SSL and TLS?

    SSL (Secure Sockets Layer) is the deprecated predecessor of TLS (Transport Layer Security). TLS is the modern, secure successor; SSL 2.0/3.0 are insecure and disabled. Current versions are TLS 1.2 and TLS 1.3.

22. What three security guarantees does TLS provide?

    Confidentiality (encryption of data in transit), Integrity (detection of tampering via MAC/AEAD), and Authentication (verifying the server's — and optionally the client's — identity via certificates).

23. Explain how TLS uses both asymmetric and symmetric encryption.

    TLS uses asymmetric (public-key) cryptography during the handshake to authenticate the server and securely establish a shared secret, then switches to fast symmetric encryption (e.g. AES) to encrypt the actual data for the session.

See more Security flashcards →

Planning Security for Back-end Web Developement

Security (Back-end Web Developement) FAQ