Now, before we dive into different
attack patterns and ways of attacking websites,
I wanna come back to the important comparison
of security to authentication
because it might sound very similar and related,
but it is only loosely related.
With authentication, we mean that we add the login,
signup and logout features to our website
and we simply differentiate between users who are anonymous,
who haven't created an account with us,
and users who we know.
That's the main difference.
And then, of course, we might unlock certain features
that our website should offer
to those privileged users who have an account.
So we have different features on the website
and some features are only accessible for logged in users.
And, of course, this is some kind of security.
If only administrators on a blog page
can delete and edit blog posts,
then, of course, adding authentication to the page
ensures that the data is protected and that malicious users
can't start deleting our blog posts.
But in the end, if you take a closer look,
it's really just about controlling
which intended website features are offered
to which audience,
but we're talking about a pool of intended actions
that should be doable by regular visitors.
We just wanna control which kind of visitors
can perform which action.
That's the idea behind authentication.
When we talk about website security, then it's different.
Here, we wanna protect against attacks and actions
that could be performed by malicious users
that should never be allowed.
There might be certain actions
that we never expect to have on our website.
No user should be able to fetch a list of all accounts
or should be able to delete database tables.
That should not be possible for any user.
No user should be able to steal the data
of other visitors of our site.
So when we talk about website security,
we wanna ensure that our website has no security holes,
no vulnerabilities that can be abused by attackers.
And even though you might not think
that you have vulnerabilities on your website,
there are a couple of common attack patterns
to which actually an astonishing amount of websites
out there are vulnerable.
And to ensure that your page is not one of those pages
that are vulnerable, in this course section,
we're going to dive into these most common
and dangerous attack patterns
so that you know how you can harden your website
and how you can protect your website
against those attack patterns.