Security E-Commerce

CSRF, secure by design, and input sanitization as a universal defense  ·  Approx. 2 class days

StarringXSS: Trust in a User · CSRF: Trust in a Site

Use this as a quick reference for the recap attacks, CSRF, secure by design, and input sanitization.

Security E-Commerce: CSRF and Secure by Design infographic

🧭 Plot Summary

You already know SQL injection, XSS, and directory traversal from 2.2.2. This activity applies them to a real e-commerce security lab, then adds one more attack that works completely differently:

SQL Injection
Malicious SQL in an input field
XSS
Malicious script run in a victim's browser
Directory Traversal
../ escapes the intended folder

CSRF (cross-site request forgery) tricks an already logged-in victim's browser into sending a request the victim never intended — exploiting the site's trust in that browser session, rather than tricking the person directly.

You'll close by learning secure by design and input sanitization — the design philosophy and the single technique that, together, prevent most of the attacks in this activity from working in the first place.

What you will do in this lesson

  • Apply what you know about SQL injection, XSS, and directory traversal to a real e-commerce security lab.
  • Learn CSRF — an attack that exploits a site's trust in an already-logged-in user's browser.
  • Study secure by design and secure by default as company-level security principles.
  • Learn why input sanitization is a single defense that blocks three different attacks at once.

Why it matters

This is where attack and defense finally converge — you now have both the attacks and the design principles that stop them, right before this section's capstone problem.

✅ Self-Check Before You Roll On

Check off each item as you get there. These are not grades — they are your own signal.