Sources

Authoritative Sources

The definitions, risks, and practices in this pack are grounded in the following primary and widely recognised web-security sources. Where a concept has a canonical standard or maintained reference (for example the OWASP Top 10 or an IETF RFC), that source is cited directly.

OWASP

  • OWASP Top 10 (web application security risks). https://owasp.org/www-project-top-ten/
  • OWASP API Security Top 10. https://owasp.org/www-project-api-security/
  • OWASP Cheat Sheet Series. https://cheatsheetseries.owasp.org/
  • OWASP Cross-Site Scripting (XSS) Prevention Cheat Sheet. https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html
  • OWASP SQL Injection Prevention Cheat Sheet. https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html
  • OWASP Cross-Site Request Forgery Prevention Cheat Sheet. https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html
  • OWASP Password Storage Cheat Sheet. https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html
  • OWASP Session Management Cheat Sheet. https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html
  • OWASP Server-Side Request Forgery Prevention Cheat Sheet. https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html
  • OWASP Application Security Verification Standard (ASVS). https://owasp.org/www-project-application-security-verification-standard/

Browser and Web Platform Documentation

  • MDN Web Docs - HTTP security headers. https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers
  • MDN Web Docs - Content Security Policy (CSP). https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP
  • MDN Web Docs - Same-origin policy. https://developer.mozilla.org/en-US/docs/Web/Security/Same-origin_policy
  • MDN Web Docs - Cross-Origin Resource Sharing (CORS). https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS
  • MDN Web Docs - Set-Cookie and SameSite. https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie
  • MDN Web Docs - Subresource Integrity. https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity
  • W3C Content Security Policy Level 3. https://www.w3.org/TR/CSP3/
  • W3C Web Authentication (WebAuthn) Level 2. https://www.w3.org/TR/webauthn-2/

Standards and Specifications (IETF / NIST)

  • RFC 9110 - HTTP Semantics (methods, status codes, idempotency). https://www.rfc-editor.org/rfc/rfc9110.html
  • RFC 6749 - The OAuth 2.0 Authorization Framework. https://www.rfc-editor.org/rfc/rfc6749.html
  • RFC 7636 - Proof Key for Code Exchange (PKCE). https://www.rfc-editor.org/rfc/rfc7636.html
  • RFC 7519 - JSON Web Token (JWT). https://www.rfc-editor.org/rfc/rfc7519.html
  • RFC 6797 - HTTP Strict Transport Security (HSTS). https://www.rfc-editor.org/rfc/rfc6797.html
  • RFC 6238 - TOTP: Time-Based One-Time Password Algorithm. https://www.rfc-editor.org/rfc/rfc6238.html
  • RFC 8446 - The Transport Layer Security (TLS) Protocol Version 1.3. https://www.rfc-editor.org/rfc/rfc8446.html
  • NIST SP 800-63B - Digital Identity Guidelines: Authentication and Lifecycle Management. https://pages.nist.gov/800-63-3/sp800-63b.html

Vulnerability and Threat References

  • CVE Program (Common Vulnerabilities and Exposures). https://www.cve.org/
  • Common Vulnerability Scoring System (CVSS), FIRST. https://www.first.org/cvss/
  • CWE - Common Weakness Enumeration, MITRE. https://cwe.mitre.org/
  • OpenID Connect Core 1.0. https://openid.net/specs/openid-connect-core-1_0.html