Chapter 7 — Networks and protocols
Lesson map
Lesson 07 published. Map, example, EX019.
flowchart TD
N0["Learning outcomes"]
N1["7.1 HTTP basics"]
N2["7.2 Cookies"]
N3["7.3 Security headers"]
N4["7.4 Downloading dependencies"]
N5["7.5 Network protections"]
N6["7.6 Outbound calls"]
N7["DNS"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX019"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["7.1 HTTP basics"]
N2["7.2 Cookies"]
N3["7.3 Security headers"]
N4["7.4 Downloading dependencies"]
N5["7.5 Network protections"]
N6["7.6 Outbound calls"]
N7["DNS"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX019"]
[Learning outcomes]
|
v
[7.1 HTTP basics]
|
v
[7.2 Cookies]
|
v
[7.3 Security headers]
|
v
[7.4 Downloading dependencies]
|
v
[7.5 Network protections]
|
v
[7.6 Outbound calls]
|
v
[DNS]
|
v
[Worked example] --> [Exercise EX019]
Learning outcomes
You will (1) explain HTTP and HTTPS for web applications; (2) describe cookies and their security attributes; (3) explain how dependencies are downloaded over networks; (4) identify network-level protections.
7.1 HTTP basics
Browsers send requests with a method (GET, POST), a path, headers and sometimes a body; servers respond with a status, headers and a body. CampusEats uses HTTPS so traffic is encrypted and the server authenticated.
Lena uses the browser's developer tools to watch an order being placed and notes each request and response. The status codes tell her what the server decided: a refused price change should return an error, not a success page with the change quietly ignored. Headers carry the session cookie and the security settings described next, so reading them is the first step in checking what the application actually does rather than what the design says.
7.2 Cookies
The session cookie identifies a logged-in student. Attributes protect it: Secure (only sent over HTTPS), HttpOnly (not readable by page scripts) and SameSite (limits sending with requests from other sites). ASVS session-management requirements specify these.
Lena checks the cookie in the browser and confirms all three attributes are set. Without HttpOnly, a cross-site scripting flaw could read the cookie and let someone act as the student. The session also expires after a period of inactivity and is replaced at login, so a cookie captured before login cannot be reused afterwards. These settings cost nothing to apply and remove whole classes of attack.
7.3 Security headers
Response headers such as Strict-Transport-Security and Content-Security-Policy tell browsers to apply extra protections; chapter 25's lab checks them.
Strict-Transport-Security tells browsers to use only HTTPS for the site in future, which stops a first request from being sent unencrypted on a café's public network. Content-Security-Policy limits where scripts may come from. Headers are only instructions: an older browser may ignore them, so they add protection rather than replace correct code. Lena records which headers CampusEats sends and which are missing, as a starting point for the later lab.
7.4 Downloading dependencies
Package managers download over HTTPS from registries. The lockfile's hashes allow checking that the bytes received are the ones expected (chapter 22).
HTTPS protects the download in transit, but it does not prove the registry served the right file. If a package were replaced on the registry or by a misconfigured mirror, HTTPS would deliver the wrong bytes securely. The hash in the lockfile closes that gap, which is exactly what stopped the CampusEats build in Lena's first week: the received file did not match the recorded hash, so the install failed rather than continuing.
7.5 Network protections
The hosting platform provides a firewall and rate limiting; the database is not reachable from the internet.
Rate limiting slows anyone trying many passwords or flooding the order page at lunchtime, and the firewall allows only web traffic to reach the application. Keeping the database off the internet means an attacker must first get through the application to reach the data. Lena confirms the setup from outside the network, under her test permission, by checking that the database port does not answer.
7.6 Outbound calls
CampusEats calls the payment provider; it only calls known addresses, which protects against server-side request forgery (OWASP A10).
The list of allowed addresses is kept in configuration, and the code refuses to fetch any address a user supplies, such as an image link in a review. Without that rule, a request could be steered to internal services that trust anything coming from inside the network. Lena adds a test that tries an internal address and checks that the request is refused before any connection is made.
DNS
Before connecting, the browser looks up the server's address using DNS. The society keeps DNS records in the university's managed service with two-person approval for changes, because a changed record could send students to a fake site. Registries and package downloads also rely on DNS, which is one reason hash checks matter.
Testing headers and cookies
A test in CI requests the home page in the test environment and checks cookie attributes and key headers, failing if any are missing.
Worked example
Lena checks the session cookie in the browser's developer tools on the test site and finds HttpOnly missing. The fix is one configuration line; a test now checks all three attributes.
Synthetic case. Configuration and findings are synthetic.
Errors and limits
Cookie attributes reduce risk but do not replace server-side session checks.
Exercises
- EX019 — Cookie attributes. Name the three cookie attributes and their purpose. Rubric: 3 = Secure, HttpOnly, SameSite with purposes; 2 = two; 1 = one; 0 = none.
- EX020 — Missing attribute. What did Lena find and fix? Rubric: 3 = HttpOnly missing; config; test; 2 = partial; 1 = vague; 0 = none.
- EX021 — SSRF protection. How does CampusEats limit SSRF? Rubric: 3 = calls only known addresses; 2 = partial; 1 = vague; 0 = none.
Synthesis
Secure protocols, cookie attributes and headers protect the web layer.
Continue studying — chapter 07 of 40
← Chapter 06 (draft) · Course chapter index · Chapter 08 (draft) →