Cyber Wiki Learning Path
Web and API Security
Understand browser security boundaries, web vulnerabilities, API authorization failures, secure input handling, and modern application defenses.
Recommended Sequence
40 connected entries
AI Model Serving Security
AI model serving security protects inference endpoints, runtimes, dependencies, model access, scaling, and operational telemetry.
AI application security · IntermediateAI Secrets Management
AI secrets management protects API keys, tokens, certificates, and credentials used by models, agents, pipelines, and tools.
API security concept · AdvancedAPI Authentication and Token Validation
API authentication and token validation establish which principal is calling an API and whether the presented credential is authentic, current, intended for that audience, and permitted to support the requested action.
Application architecture concept · AdvancedAPI Gateway Security
An API gateway is an intermediary that routes and mediates API traffic and may enforce authentication, rate limits, schema controls, observability, transformation, and policy; securing it requires consistent edge policy without assuming the gateway can replace backend authorization.
API security · AdvancedAPI Token Scope Design
API token scope design grants an automation client only the operations, resources, environments, and duration needed for its approved purpose.
API security · AdvancedAPI-Based Data Ingestion Security
API-based data ingestion security validates the source, identity, authorization, format, rate, and integrity of data accepted through programmatic interfaces.
Secure automation · AdvancedAutomation Secret Management
Automation secret management keeps passwords, tokens, keys, and certificates out of code and logs while delivering them only to authorized jobs at execution time.
Browser interface attack · IntermediateClickjacking
Clickjacking overlays or frames a legitimate interface so a user’s visible click lands on a hidden or disguised control, causing an unintended action in the user’s authenticated session.
Governance practice · AdvancedCloud AI Services Governance
Cloud AI services governance controls how managed machine-learning, generative AI, language, vision, and decision services are selected, configured, and used.
Application architecture · AdvancedCloud API Management
Cloud API management publishes, secures, observes, versions, and governs interfaces used by applications, partners, and services.
Security architecture · AdvancedCloud Control Plane Security
The cloud control plane contains the APIs, consoles, identities, and orchestration functions used to create and change cloud resources.
Audit control · IntermediateCloud Control-Plane Logging
Cloud control-plane logging records administrative and API actions that create, change, or delete cloud resources and policies.
Architecture concept · BeginnerCloud Elasticity and Scalability
Scalability is the ability to support increased demand by adding capacity, while elasticity is the ability to adjust that capacity quickly as demand changes.
Data and identity control · IntermediateCloud Secrets Management
Cloud secrets management protects passwords, API keys, tokens, certificates, and other sensitive values needed by applications and automation.
Operational concept · IntermediateCloud Service Quotas and Capacity
Cloud service quotas limit the number, rate, size, or regional availability of resources and API operations.
Application vulnerability class · AdvancedCommand Injection
Command injection occurs when untrusted data is incorporated into an operating-system command or shell expression and changes the command’s intended structure, arguments, control flow, or executed program.
Browser security control · AdvancedContent Security Policy
Content Security Policy is an HTTP response policy that tells supporting browsers which sources and execution patterns are permitted for scripts, styles, images, frames, connections, and other resources, reducing the impact of many content-injection flaws.
Web session-security concept · IntermediateCookies and Web Sessions
Cookies are browser-managed name-value records scoped by domain, path, security attributes, and lifetime; web applications often use them to carry a session identifier that binds requests to server-side authentication and authorization state.
Application security concept · IntermediateCross-Site Request Forgery
Cross-Site Request Forgery is an application-security topic involving trust boundaries, input handling, browser or API behavior, identity, authorization, or server-side processing.
Application security concept · IntermediateCross-Site Scripting
Cross-Site Scripting is an application-security topic involving trust boundaries, input handling, browser or API behavior, identity, authorization, or server-side processing.
Cloud concept · BeginnerEssential Characteristics of Cloud Computing
The essential characteristics of cloud computing describe the operating behaviors that distinguish cloud services from ordinary hosting.
Application security concept · IntermediateFile Upload Security
File Upload Security is an application-security topic involving trust boundaries, input handling, browser or API behavior, identity, authorization, or server-side processing.
API security concept · AdvancedGraphQL Security
GraphQL security protects a typed query interface in which clients select fields and traverse relationships; the server must enforce authorization, resource limits, safe resolver behavior, and controlled schema exposure for every requested object and field.
Web protocol foundation · FoundationalHTTP Methods and Status Codes
HTTP methods express the intended action on a resource, while status codes communicate the outcome; secure applications enforce authorization and state rules for every method and return responses that are accurate without disclosing unnecessary detail.
Investigation practice · IntermediateIncident Hypothesis Development
Incident hypothesis development frames testable explanations for observed activity, expected evidence, competing possibilities, and the next collection actions needed to reduce uncertainty.
AI application security · AdvancedInference API Security
Inference API security protects model-serving interfaces against unauthorized use, abuse, extraction, privacy attacks, resource exhaustion, and unsafe input or output handling.
Automation security · IntermediateInfrastructure-as-Code State Security
Infrastructure-as-code state security protects the files, backends, locks, credentials, and metadata used to compare declared infrastructure with real resources and plan changes.
Application security concept · IntermediateInsecure Deserialization
Insecure Deserialization is an application-security topic involving trust boundaries, input handling, browser or API behavior, identity, authorization, or server-side processing.
Mobile security foundation · IntermediateMobile Application Architecture
Mobile application architecture combines device code, operating-system services, local storage, backend APIs, identity providers, push services, update channels, and third-party SDKs; security depends on how trust and data move across all of those components.
Security testing practice · AdvancedMobile Application Security Testing
Mobile application security testing evaluates architecture, storage, cryptography, authentication, network communication, platform interaction, code quality, resilience, privacy, backend APIs, and release integrity across supported mobile platforms.
Application vulnerability class · IntermediatePath Traversal
Path traversal occurs when untrusted input influences a file or directory path and allows access outside the application’s intended storage boundary through relative segments, alternate encodings, symbolic links, or platform-specific path behavior.
Application security concept · IntermediateREST API Security
REST API Security is an application-security topic involving trust boundaries, input handling, browser or API behavior, identity, authorization, or server-side processing.
Application security concept · IntermediateSame-Origin Policy and Cross-Origin Resource Sharing
Same-Origin Policy and Cross-Origin Resource Sharing is an application-security topic involving trust boundaries, input handling, browser or API behavior, identity, authorization, or server-side processing.
Application security practice · IntermediateSecrets Management
Secrets management controls the creation, storage, distribution, use, rotation, revocation, and auditing of passwords, tokens, API keys, certificates, and cryptographic material.
Architecture practice · AdvancedSecure Interface Design
Secure interface design controls how components exchange data, identity, commands, state, and errors across technical and organizational boundaries.
Application security concept · IntermediateServer-Side Request Forgery
Server-Side Request Forgery is an application-security topic involving trust boundaries, input handling, browser or API behavior, identity, authorization, or server-side processing.
Web protocol foundation · FoundationalURLs, URIs, and HTTP Request Structure
A URI identifies a resource, a URL adds a method and location for reaching it, and an HTTP request carries a method, target, headers, and optional body that a server interprets within an application and trust context.
Testing practice · IntermediateWeb Application Penetration Testing
Web application penetration testing evaluates how an application handles identity, authorization, input, sessions, business rules, APIs, dependencies, and trust boundaries under realistic misuse.
Real-time application security concept · AdvancedWebSocket Security
WebSocket security protects long-lived, bidirectional connections that begin with an HTTP upgrade and then carry application-defined messages outside the normal request-response pattern.
Application vulnerability class · AdvancedXML External Entity Processing
XML External Entity risk arises when an XML parser resolves attacker-controlled external entities or related document features, potentially reading local resources, making server-side requests, disclosing data, or consuming excessive resources.