Web Security and Privacy

  1. Authentication and Authorization
    1. Authentication Mechanisms
      1. Password-Based Authentication
        1. Password Policies
          1. Password Managers
          2. Multi-Factor Authentication
            1. Something You Know
              1. Something You Have
                1. Something You Are
                  1. MFA Implementation Challenges
                  2. Passwordless Authentication
                    1. Hardware Tokens
                      1. Biometric Authentication
                    2. Authorization and Access Control
                      1. Role-Based Access Control
                        1. Roles and Permissions
                          1. Implementation Patterns
                          2. Attribute-Based Access Control
                            1. Policy Definition
                              1. Attribute Management
                              2. Access Control Lists
                                1. Resource-Based ACLs
                                  1. User and Group Permissions
                                  2. Insecure Direct Object References
                                    1. Exploitation Techniques
                                      1. Prevention Strategies
                                    2. Federated Identity and Single Sign-On
                                      1. Security Assertion Markup Language
                                        1. SAML Assertions
                                          1. SAML Flows
                                          2. OpenID Connect
                                            1. OIDC Protocol Flow
                                              1. ID Tokens
                                            2. OAuth 2.0 Framework
                                              1. OAuth Roles
                                                1. Resource Owner
                                                  1. Client
                                                    1. Authorization Server
                                                      1. Resource Server
                                                      2. Grant Types
                                                        1. Authorization Code Grant
                                                          1. Implicit Grant
                                                            1. Resource Owner Password Credentials Grant
                                                              1. Client Credentials Grant
                                                              2. Access Tokens and Refresh Tokens
                                                                1. Token Lifetimes
                                                                  1. Token Revocation
                                                                2. JSON Web Tokens
                                                                  1. JWT Structure
                                                                    1. Header
                                                                      1. Payload
                                                                        1. Signature
                                                                        2. Security Considerations
                                                                          1. Token Expiry
                                                                            1. Signature Verification
                                                                              1. Token Storage

                                                                          Previous

                                                                          5. Cryptography in Web Security

                                                                          Go to top

                                                                          Next

                                                                          7. Web Privacy