Security is a very broad topic and it covers many aspects. Due to the scope of this book, we will mainly focus on the security that a web application needs to take care of, which includes authentication, authorization, and preventing attacks such as Cross-Site Scripting (XSS) and SQL/NoSQL injection. Topics such as how to secure a server or how to prevent a distributed denial-of-service (DDoS) attack will not be covered here.
So, how do we secure a web application? It really comes down to three aspects:
- Authenticating users
- Authorizing users
- Preventing attacks
Let's take TaskAgile as an example. We want only those users that we have authenticated to access the application. So, people will need to log in to the application before using it, except the register and the login page, which are accessible publicly. We also want to limit the resources that authenticated users can access to only those that they have been authorized for. For example, they should not be...