How security attacks work
When a malicious party exploits vulnerabilities or missing security features in an application to cause damage, that exploit is called an attack. Because an insecure application can expose users and systems to various types of harm, understanding attack types is a first step toward protecting your app.
Attacks fall into two broad categories: active and passive.
Active attacks
In an active attack, the attacker directly attempts to break into the application. Methods vary widely, from assuming a false identity to access sensitive data, known as a masquerade attack, to overwhelming a server with traffic until the application becomes unresponsive, which is a denial of service attack.
Active attacks can also target data in transit. An attacker may alter application data before it reaches a user's browser, either displaying modified information on the site or redirecting the user to an unintended destination. This is sometimes called modification of messages.
Passive attacks
A passive attack involves collecting or learning information from the application without affecting the application itself.
Consider someone eavesdropping on a private conversation to gather details about your personal life and relationships. The same applies to web traffic. An attacker can capture data exchanged between the browser and server, collecting usernames, passwords, users' browsing history, and other exchanged data.
Defending your application
Attackers can harm an application directly or perform malicious operations on a site without detection by either you or your users. This makes mechanisms to detect and protect against attacks essential.
There is no single solution to make an application completely secure. Instead, security features and techniques are typically applied in layers to prevent or further delay an attack, a practice known as defense in depth. For example, if an application contains a form, you might validate inputs in the browser, then on the server, and finally at the database, while also using HTTPS to secure data as it travels in transit.
Because many attacks occur without ever reaching your server, it can be difficult to detect when an attack is happening. The good news is that modern web browsers already include powerful built-in security features, which are covered in the next topic on how browsers mitigate attacks.
