Build secure software and web applications
Move from security requirements through safe implementation, browser boundaries, authorization tests, and vulnerability response.
Topic index
Software and Application Security
Learn how secure software design, browser boundaries, defensive coding, and verification prevent application vulnerabilities.
Topic index
Understand this domain
Pomerium coverage
Pomerium can authenticate a request, apply route policy, protect an application entry point, and provide verified identity context. The application still owns input handling, browser controls, object authorization, business invariants, data protection, safe failure, and vulnerability response.
Limits
- An authenticated route does not make the application code or its dependencies safe.
- A web application firewall or input filter cannot replace parameterization, contextual encoding, object authorization, or safe APIs.
- A passing scanner does not prove that business logic, alternate paths, state transitions, and exceptional conditions are secure.
Primary sources
2 learning paths
Paths for this topic
Protect data with applied cryptography
Learn cryptographic primitives, key systems, data lifecycle controls, storage protection, and migration without inventing protocols.
8 related guides
Guides in this topic
Build application security requirements
Turn application risks into testable security requirements, assurance levels, negative tests, and evidence with OWASP ASVS.
Defend outbound requests from SSRF
Design a webhook, import, preview, or fetch service with strict destination, redirect, credential, egress, and resource policy.
Design application cryptography
Select a standard construction and define keys, nonces, context, record format, failure behavior, tests, and migration before coding.
Manage application vulnerabilities
Receive, reproduce, triage, remediate, verify, disclose, deploy, and learn from application vulnerability reports.
Protect application data with cryptography
Choose transport, application, database, filesystem, storage, and in-use protections from the data threat model and key boundary.
Secure browser origin boundaries
Design origins, sessions, cross-origin reads, state changes, frames, messages, and scripts as separate browser security controls.
Test application authorization
Verify object, property, action, workflow, tenant, and administrative authorization with a systematic identity and state matrix.
Validate and encode untrusted data
Build typed validation, canonicalization, parameterization, sanitization, and output encoding at every application boundary.
22 related terms
Concepts in this topic
Business Logic Abuse
Protect workflow order, object state, quotas, prices, approvals, and other business invariants from valid-looking misuse.
Canonicalization
Convert equivalent input representations to one defined form before comparison, validation, authorization, and storage.
Command Injection
Avoid command interpreters and pass fixed executables and validated arguments through structured process APIs with narrow authority.
Cross-Origin Resource Sharing (CORS)
Grant selected browser origins permission to read cross-origin responses without treating CORS as authentication or request blocking.
Cross-Site Request Forgery (CSRF)
Stop another origin from causing an authenticated browser to perform an unwanted state-changing request.
Cross-Site Scripting (XSS)
Prevent untrusted data from executing as active browser content through context-aware encoding, safe DOM APIs, and constrained markup.
File Upload Security
Validate, transform, store, scan, and serve untrusted files through bounded stages with separate names, origins, and authority.
HTTP Request Smuggling
Prevent HTTP intermediaries from disagreeing about message boundaries, request length, transfer coding, and the start of the next request.
Injection
Prevent attacker-controlled data from changing the structure or meaning of a command sent to an interpreter.
Input Validation and Output Encoding
Validate syntax and meaning at input boundaries, then encode untrusted data for the exact output interpreter and context.
Memory Safety
Prevent spatial, temporal, initialization, and type-safety errors that can corrupt memory, disclose data, or redirect control flow.
Path Traversal
Prevent attacker-controlled file names and paths from escaping an approved storage root after decoding and canonical resolution.
Privilege Separation
Split a service into components with different authority so compromise of one parser or workflow does not grant the complete service privilege.
Race Condition and TOCTOU
Prevent security decisions from becoming stale before the protected state change, resource use, or authorization commit completes.
Same-Origin Policy
Understand how scheme, host, and port define a browser origin and limit cross-origin reads, script access, and storage.
Secure Error Handling
Fail safely without bypassing controls, exposing sensitive internals, duplicating effects, or leaving partial security state.
Secure Software Development Lifecycle
Integrate security requirements, design review, safe implementation, verification, release controls, and vulnerability response.
Security Misconfiguration
Prevent unsafe defaults, unnecessary features, exposed diagnostics, excessive authority, and configuration drift across environments.
Server-Side Request Forgery (SSRF)
Prevent untrusted input from making a server reach internal services, cloud metadata, local files, or other unapproved destinations.
SQL Injection
Keep untrusted values separate from SQL structure with parameterized queries, allowlisted identifiers, and narrow database authority.
Unsafe Deserialization
Treat serialized objects as untrusted data and prevent input from selecting executable types, constructors, hooks, or object graphs.
Vulnerability and Exploit
Distinguish a software weakness, exploitable vulnerability, exploit path, exposure, and resulting security impact.
