CSP
CSP stands for Content Security Policy, an HTTP response header (Content-Security-Policy) that whitelists the sources from which content such as scripts, styles, and images may load. A strict nonce- or hash-based policy is a leading mitigation against cross-site scripting because non-whitelisted inline script is blocked by the browser.
CSRF
CSRF stands for Cross-Site Request Forgery, an attack that abuses a logged-in user's automatically attached cookies to perform unintended state-changing requests. It is countered with anti-CSRF tokens and the SameSite cookie attribute.
XSS
XSS stands for Cross-Site Scripting, an injection vulnerability in which attacker-controlled script executes in a victim's browser within a trusted site's origin. It comes in stored, reflected, and DOM-based forms and is mitigated by context-aware output encoding plus CSP.
SSRF
SSRF stands for Server-Side Request Forgery, where an attacker coerces the server into making requests to attacker-chosen destinations, often internal services or the cloud metadata endpoint. Allow-listing destinations and blocking internal IP ranges are the core defenses.
IDOR
IDOR stands for Insecure Direct Object Reference, a broken-access-control flaw where user-supplied identifiers reach objects without an ownership check. It is the practical equivalent of Broken Object Level Authorization (BOLA) in API security.
BOLA
BOLA stands for Broken Object Level Authorization, the top risk in the OWASP API Security Top 10. It occurs when an API trusts a client-supplied object ID without verifying the caller is authorized for that specific object.
SQLi
SQLi stands for SQL Injection, an injection attack that manipulates the structure of a database query via untrusted input. The definitive countermeasure is parameterized queries (prepared statements) rather than string concatenation.
TLS
TLS stands for Transport Layer Security, the protocol securing data in transit and underpinning HTTPS. TLS 1.3 is the current recommended version, offering a faster handshake and the removal of legacy, weak cipher suites.
SSL
SSL stands for Secure Sockets Layer, the deprecated predecessor of TLS. The term "SSL certificate" persists colloquially, but all SSL versions are insecure and obsolete; modern systems use TLS.
HSTS
HSTS stands for HTTP Strict Transport Security, a response header that forces browsers to use HTTPS for a host for a set duration. It defends against SSL-stripping and protocol-downgrade attacks, and can be extended via the preload list.
MFA
MFA stands for Multi-Factor Authentication, requiring two or more independent factors (knowledge, possession, inherence) to log in. Phishing-resistant MFA based on WebAuthn/FIDO2 is far stronger than SMS or one-time codes.
2FA
2FA stands for Two-Factor Authentication, the most common form of MFA, combining exactly two factors such as a password plus a TOTP code or security key. It blocks attacks that rely on a stolen password alone.
TOTP
TOTP stands for Time-based One-Time Password (RFC 6238), a six- to eight-digit code derived from a shared secret and the current time, displayed by authenticator apps. It is a common second factor but, unlike WebAuthn, remains phishable.
OAuth
OAuth refers to OAuth 2.0, an authorization framework for delegated, token-based access to a user's resources without sharing the password. It handles authorization, not authentication; OpenID Connect adds the identity layer.
OIDC
OIDC stands for OpenID Connect, an authentication layer on top of OAuth 2.0 that issues an ID token (a signed JWT) describing the authenticated user. It provides standardized login and profile claims for relying parties.
JWT
JWT stands for JSON Web Token (RFC 7519), a compact, signed, URL-safe token carrying JSON claims for stateless auth. Its payload is signed but not secret, and the signature must always be verified with an expected algorithm.
PKCE
PKCE stands for Proof Key for Code Exchange, an OAuth 2.0 extension that binds an authorization code to a per-request secret so a stolen code cannot be redeemed. It is mandatory for public clients and standard in OAuth 2.1.
CORS
CORS stands for Cross-Origin Resource Sharing, a browser-enforced mechanism that lets servers opt in to cross-origin requests via response headers. It relaxes the same-origin policy and is not itself an access-control or authentication system.
SOP
SOP stands for Same-Origin Policy, the browser rule that isolates documents and scripts by origin (scheme, host, port). It is the cornerstone of browser security and the reason CORS exists.
SRI
SRI stands for Subresource Integrity, a browser feature where an integrity hash on a script or stylesheet ensures the fetched file matches the expected content. It protects against tampered or compromised CDN-hosted assets.
WAF
WAF stands for Web Application Firewall, an HTTP-traffic filter that blocks requests matching known attack signatures. It is defense in depth and a virtual-patching tool, never a replacement for secure coding.
OWASP
OWASP stands for the Open Worldwide Application Security Project, a nonprofit producing free security resources including the Top 10, the API Security Top 10, the ASVS, and the Cheat Sheet Series. Its lists are de facto industry references for web risks.
ASVS
ASVS stands for the OWASP Application Security Verification Standard, a framework of testable security requirements organized into levels (1-3). Teams use it as a checklist for design, development, and security testing.
CVE
CVE stands for Common Vulnerabilities and Exposures, a catalog of publicly disclosed security flaws, each with a unique identifier like CVE-2021-44228. It provides a common reference so tools and advisories can name the same vulnerability.
CVSS
CVSS stands for the Common Vulnerability Scoring System, a standard for rating the severity of a vulnerability on a 0-10 scale from exploitability and impact metrics. It helps teams prioritize remediation but should be combined with business context.
SAST
SAST stands for Static Application Security Testing, analysis of source code or binaries for vulnerabilities without executing the program. It finds flaws early in the pipeline but produces false positives and cannot see runtime configuration.
DAST
DAST stands for Dynamic Application Security Testing, which probes a running application from the outside as an attacker would. It catches configuration and runtime issues that static analysis misses but provides less precise source-level localization.
SBOM
SBOM stands for Software Bill of Materials, a formal inventory of the components and dependencies in a piece of software. It is central to managing supply-chain risk and responding quickly to newly disclosed dependency vulnerabilities.
CSRF Token
A CSRF token is an unpredictable, per-session or per-request value the server issues and validates to confirm a state-changing request originated from its own forms. The synchronizer-token and double-submit-cookie patterns are the two common implementations.
RBAC
RBAC stands for Role-Based Access Control, an authorization model that grants permissions to roles and assigns roles to users. It simplifies management at scale; ABAC (attribute-based) adds finer, context-aware rules when roles alone are too coarse.
PII
PII stands for Personally Identifiable Information, data that can identify an individual such as name, email, government ID, or location. Web systems must protect it with encryption, access control, and data-minimization, and handle it under laws like the GDPR.
DoS / DDoS
DoS stands for Denial of Service and DDoS for Distributed Denial of Service, attacks that exhaust a target's resources to make it unavailable, the distributed form using many compromised hosts. Web mitigations include rate limiting, CDNs, traffic scrubbing, and autoscaling with circuit breakers.