UNIT1-AWAS.pdf

CSF- 403 ADVANCED WEB APPLICATIONS SECURITY UNIT I Aditya Rajesh More What is a web application? A web application (web app) is an application program that is stored on a remote server and delivered over the internet through a browser interface. Web services are web apps by definition and ma...

CSF- 403 ADVANCED WEB APPLICATIONS SECURITY UNIT I Aditya Rajesh More What is a web application? A web application (web app) is an application program that is stored on a remote server and delivered over the internet through a browser interface. Web services are web apps by definition and many, although not all, websites contain web apps. Developers design web applications for a wide variety of uses and users, from an organization to an individual for numerous reasons. Commonly used web applications can include webmail, online calculators or e-commerce shops. While users can only access some web apps by a specific browser, most are available no matter the browser. Advanced Web Applications Security Unit I- by Aditya More 2 How web applications work Web applications do not need to be downloaded since they are accessed through a network. Users can access a web application through a web browser, such as Google Chrome, Mozilla Firefox or Safari. For a web app to operate, it needs a web server, application server and database. Web servers manage the requests that come from a client, while the application server completes the requested task. A database stores any necessary information. Web applications typically have short development cycles and small development teams. Developers write most web apps in JavaScript, HTML5 or CSS. Client-side programming typically utilizes these languages, which help build an application's front-end. Server-side programming creates the scripts a web app will use. Languages such as Python, Java and Ruby are commonly used in server-side programming. Advanced Web Applications Security Unit I- by Aditya More 3 How web applications work Advanced Web Applications Security Unit I- by Aditya More 4 How web applications work A web app requires mainly three elements to function properly. This includes a web server to handle requests from the client, an application server to execute the tasks requested and a database to store the information. Here is how a web application typically works: The user would connect to the Internet and create a request to the web server through the application's user interface. The web server would process the request and send it to the right web app server. Advanced Web Applications Security Unit I- by Aditya More 5 How web applications work The web application server would perform the required task and generate the results of the required data. The web app server would send the information back to the web server. The web server would send the requested information to the client's device such as a laptop, desktop or mobile phone. The requested information would appear on the user's display. Advanced Web Applications Security Unit I- by Aditya More 6 Web Application Three Tier Architecture Layers Web application architectural patterns are separated into many different layers or tiers which is called Multi- or Three-Tier Architecture. You can easily replace and upgrade each layer independently. Advanced Web Applications Security Unit I- by Aditya More 7 Web Application Three Tier Architecture Layers Presentation Layer: This layer is accessible to the client via a browser and it includes user interface components and UI process components. As we have already discussed that these UI components are built with HTML, CSS, and JavaScript (and its frameworks or library) where each of them plays a different role in building the user interface. Business Layer: It is also referred to as a Business Logic or Domain Logic or Application Layer. It accepts the user’s request from the browser, processes it, and regulates the routes through which the data will be accessed. The whole workflow is encoded in this layer. You can take the example of booking a hotel on a website. A traveler will go through a sequence of events to book the hotel room and the whole workflow will be taken care of by the business logic. Advanced Web Applications Security Unit I- by Aditya More 8 Web Application Three Tier Architecture Layers Persistence Layer: It is also referred to as a storage or data access layer. This layer collects all the data calls and provides access to the persistent storage of an application. The business layer is closely attached to the persistence layer, so the logic knows which database to talk to and the process of retrieving data becomes more optimized. A server and a database management system software exist in data storage infrastructure which is used to communicate with the database itself, applications, and user interfaces to retrieve data and parse it. You can store the data in hardware servers or in the cloud. Advanced Web Applications Security Unit I- by Aditya More 9 Difference Between Website And Web Application Aspect Website Web Application Provides information and content to Enables users to perform specific tasks Purpose users. and interact with functionalities. Typically static, with infrequent Dynamic, changing based on user Content updates. interactions and real-time data. High interaction, allowing data input Limited to clicking links, reading User Interaction and manipulation with immediate content. feedback. Focuses on delivering information (e.g., Offers specific functionalities (e.g., Functionality articles, images). booking tickets, managing data). Email clients (Gmail), online banking, Examples Blogs, news sites, corporate websites. social networks (Facebook). Advanced Web Applications Security Unit I- by Aditya More 10 Difference Between Website And Web Application Aspect Website Web Application Users navigate via links to explore Task-oriented navigation, designed to Navigation content. complete specific workflows. Utilizes HTML, CSS, extensive Uses HTML, CSS, and some JavaScript, frameworks (React, Technology JavaScript. Angular), and back-end technologies (Node.js). More complex, requiring interactive Development Generally simpler, with minimal back- elements, real-time processing, and full- Complexity end integration. stack development. Usually required for personalized User Authentication Often not required. experiences and data security. Response to User Real-time processing and updates based Limited and predefined. Input on user actions. Advanced Web Applications Security Unit I- by Aditya More 11 Benefits Of Web Applications Accessibility: Cross-Platform Compatibility: Accessible from any device with a web browser, regardless of the operating system. No Installation Required: Users can access the application without needing to install any software. Centralized Data: Consistent Data Access: Data is stored centrally, allowing for real-time access and updates by multiple users. Data Security: Centralized storage enables better control over data security and backup processes. Advanced Web Applications Security Unit I- by Aditya More 12 Benefits Of Web Applications Ease of Maintenance: Single Update Point: Updates and maintenance are performed on the server side, ensuring all users have the latest version without needing individual updates. Reduced Downtime: Maintenance can often be carried out with minimal disruption to users. Scalability: Flexible Resource Management: Webapps can scale efficiently to handle increasing numbers of users and data. Cloud Integration: Many webapps can leverage cloud services to dynamically scale resources as needed. Advanced Web Applications Security Unit I- by Aditya More 13 Benefits Of Web Applications Cost-Effectiveness: Lower Development Costs: Typically cheaper to develop and deploy compared to native applications for multiple platforms. Reduced Hardware Requirements: Users do not need high-end hardware since processing is handled on the server side. Enhanced Collaboration: Real-Time Interaction: Supports real-time data sharing and collaboration among users. Multi-User Environment: Facilitates simultaneous access and collaborative tasks, improving productivity. Advanced Web Applications Security Unit I- by Aditya More 14 Benefits Of Web Applications User Experience: Consistent UI/UX: Provides a uniform user experience across different devices and platforms. Continuous Improvement: Easier to gather user feedback and implement improvements quickly. Integration Capabilities: API Integration: Easily integrates with other web services and third-party APIs for extended functionality. Modular Architecture: Supports adding new features and integrations without significant rework. Advanced Web Applications Security Unit I- by Aditya More 15 Benefits Of Web Applications Security: Centralized Security Protocols: Enhanced security measures can be implemented and managed centrally. Controlled Access: Easier to manage user permissions and access levels. Analytics and Monitoring: Usage Tracking: Simplifies tracking user behavior and performance metrics to inform decision- making. Automated Monitoring: Facilitates automated monitoring and reporting for better system management. Advanced Web Applications Security Unit I- by Aditya More 16 Client-server model The Client-server model is a distributed application structure that partitions tasks or workloads between the providers of a resource or service, called servers, and service requesters called clients. In the client-server architecture, when the client computer sends a request for data to the server through the internet, the server accepts the requested process and delivers the data packets requested back to the client. Clients do not share any of their resources. Examples of the Client-Server Model are Email, World Wide Web, etc. Advanced Web Applications Security Unit I- by Aditya More 17 How Does the Client-Server Model Work? Client: When we say the word Client, it means to talk of a person or an organization using a particular service. Similarly in the digital world, a Client is a computer (Host) i.e. capable of receiving information or using a particular service from the service providers (Servers). A client is a program that runs on the local machine requesting service from the server. A client program is a finite program means that the service started by the user and terminates when the service is completed. Servers: Similarly, when we talk about the word Servers, It means a person or medium that serves something. Similarly in this digital world, a Server is a remote computer that provides information (data) or access to particular services. A server is a program that runs on the remote machine providing services to the clients. When the client requests for a service, then the server opens the door for the incoming requests, but it never initiates the service. Advanced Web Applications Security Unit I- by Aditya More 18 How Does the Client-Server Model Work? Advanced Web Applications Security Unit I- by Aditya More 19 What is DNS? The Domain Name System (DNS) is the phonebook of the Internet. Humans access information online through domain names, like nytimes.com or espn.com. Web browsers interact through Internet Protocol (IP) addresses. DNS translates domain names to IP addresses so browsers can load Internet resources. DNS servers eliminate the need for humans to memorize IP addresses such as 192.168.1.1 (in IPv4), or more complex newer alphanumeric IP addresses such as 2400:cb00:2048:1::c629:d7a2 (in IPv6). Advanced Web Applications Security Unit I- by Aditya More 20 How does DNS work? The process of DNS resolution involves converting a hostname (such as www.example.com) into a computer-friendly IP address (such as 192.168.1.1). An IP address is given to each device on the Internet, and that address is necessary to find the appropriate Internet device - like a street address is used to find a particular home. When a user wants to load a webpage, a translation must occur between what a user types into their web browser (example.com) and the machine-friendly address necessary to locate the example.com webpage. Advanced Web Applications Security Unit I- by Aditya More 21 How does DNS work? There are 4 DNS servers involved in loading a webpage 1. DNS Recursor: Similar to a librarian, it receives queries from clients and initiates the search for the required DNS information across various servers. 2. Root Nameserver: Acts like a library index, directing the DNS Recursor to specific TLD nameservers for further details. 3. TLD Nameserver: Comparable to a specific book rack, it narrows down the search to a particular top- level domain, such as ".com". 4. Authoritative Nameserver: Like a dictionary providing a definition, it delivers the exact IP address for the requested hostname, completing the DNS query process. Advanced Web Applications Security Unit I- by Aditya More 22 How does DNS work? Advanced Web Applications Security Unit I- by Aditya More 23 How Does DNS Route Traffic To Your Web Application? Advanced Web Applications Security Unit I- by Aditya More 24 How Does DNS Route Traffic To Your Web Application? A user opens a web browser, enters www.example.com in the address bar, and presses Enter. The request for www.example.com is routed to a DNS resolver, which is typically managed by the user's Internet service provider (ISP), such as a cable Internet provider, a DSL broadband provider, or a corporate network. The DNS resolver for the ISP forwards the request for www.example.com to a DNS root name server. The DNS resolver for the ISP forwards the request for www.example.com again, this time to one of the TLD name servers for.com domains. The name server for.com domains responds to the request with the names of Authoritative DNS Servers that are associated with the example.com domain. The DNS resolver for the ISP chooses an Authoritative DNS Server name server and forwards the request for www.example.com to that name server. Advanced Web Applications Security Unit I- by Aditya More 25 How Does DNS Route Traffic To Your Web Application? The Authoritative DNS Server looks in the example.com hosted zone for the www.example.com record, gets the associated value, such as the IP address for a web server, 192.0.2.44, and returns the IP address to the DNS resolver. The DNS resolver for the ISP finally has the IP address that the user needs. The resolver returns that value to the web browser. The DNS resolver also caches (stores) the IP address for example.com for an amount of time that you specify so that it can respond more quickly the next time. The web browser sends a request for www.example.com to the IP address that it got from the DNS resolver. The web server or other resource at 192.0.2.44 returns the web page for www.example.com to the web browser, and the web browser displays the page. Advanced Web Applications Security Unit I- by Aditya More 26 Web Application Proxy Definition: A web application proxy acts as an intermediary between users and web applications. It forwards requests from users to the web application servers and returns the responses from the servers back to the users. Purpose: To enhance security, performance, and management of web applications. Advanced Web Applications Security Unit I- by Aditya More 27 Web Application Proxy How It Works? User Request: A user tries to access a web application by entering a URL in their browser. Proxy Interception: The request is intercepted by the web application proxy. Authentication: The proxy may check if the user is authorized to access the application. Forward Request: If authorized, the proxy forwards the request to the appropriate web application server. Server Response: The web application server processes the request and sends the response back to the proxy. Proxy Response: The proxy sends the server's response back to the user's browser. Advanced Web Applications Security Unit I- by Aditya More 28 Web Application Proxy Key Functions Access Control: A web application proxy checks if users are allowed to access certain web applications. It works with systems like Active Directory to make sure only authorized users can get in. This keeps sensitive information safe by ensuring only the right people can see it. Security Protection: The proxy acts like a security guard for web applications, protecting them from various attacks like DDoS, SQL injection, and cross-site scripting. It filters and monitors incoming traffic to block harmful requests, making the web applications safer and reducing the risk of data breaches. SSL/TLS Termination: The proxy handles the secure connections by encrypting and decrypting data, so the web servers don’t have to. This makes secure communication faster and easier for the web servers, improving overall performance and efficiency. Advanced Web Applications Security Unit I- by Aditya More 29 Web Application Proxy Load Balancing: The proxy spreads incoming traffic evenly across multiple servers, so no single server gets overwhelmed. This ensures the web applications run smoothly and quickly, even during busy times, providing a better experience for users. Caching: The proxy stores copies of frequently accessed content, so it can deliver it quickly without repeatedly fetching it from the web servers. This reduces the load on the servers and speeds up response times for users, especially for static content like images and scripts. Advanced Web Applications Security Unit I- by Aditya More 30 Web Application Proxy Traffic Monitoring and Logging: The proxy keeps track of all user activity and requests, providing detailed logs that help understand how the web applications are being used. This information is useful for troubleshooting issues, conducting security audits, and optimizing performance. Application Delivery: The proxy ensures that updates and changes to web applications are deployed smoothly, without causing downtime. This means users always have access to the latest version of the web applications, enjoying new features and improvements without interruption. Advanced Web Applications Security Unit I- by Aditya More 31 Same-Origin Policy (SOP) Definition: The Same-Origin Policy (SOP) is a security feature implemented by web browsers that restricts how documents or scripts loaded from one origin can interact with resources from another origin. How it Works: Origin: An origin consists of the protocol (http/https), domain, and port number. Two URLs have the same origin if all these components are identical. Policy: Under SOP, a web page at one origin (e.g., http://example.com) can typically only access resources from the same origin, not from a different one (e.g., http://another-example.com). Example: If a script on http://example.com tries to make a request to http://another-example.com, the browser blocks it due to SOP unless explicitly allowed. Advanced Web Applications Security Unit I- by Aditya More 32 Same-Origin Policy (SOP) Purpose: Security: SOP helps prevent malicious scripts from accessing sensitive data on other websites. It's a fundamental security measure in web browsers. Data Isolation: It ensures that data from one origin is isolated from data on other origins, enhancing user privacy and security. Advanced Web Applications Security Unit I- by Aditya More 33 Cross-Origin Resource Sharing (CORS) Definition: Cross-Origin Resource Sharing (CORS) is a mechanism that allows web servers to specify which origins are permitted to access the resources on a server, relaxing the restrictions of the Same-Origin Policy. How it Works: CORS Headers: When a browser makes a cross-origin request, the server can include special CORS headers in the response. Access-Control-Allow-Origin: Specifies which origins are allowed to access the resource. Other CORS Headers: Additional headers like Access-Control-Allow-Methods and Access-Control- Allow-Headers specify allowed HTTP methods and headers. Preflight Requests: For certain requests (like those with custom headers or methods), the browser may first send a preflight request (OPTIONS) to check if the server allows the actual request. Advanced Web Applications Security Unit I- by Aditya More 34 Cross-Origin Resource Sharing (CORS) Purpose: Cross-Origin Communication: CORS enables controlled sharing of resources across different origins while maintaining security. API Access: It allows web applications hosted on one domain to securely access APIs and resources hosted on another domain. Advanced Web Applications Security Unit I- by Aditya More 35 Cookies Definition: Cookies are small text files created by websites and stored on your device by your web browser. Each cookie consists of a name, value, and optional attributes like expiration date, path, domain, and security settings. Purpose and Uses: Session Management: Cookies help manage sessions by storing session IDs, keeping users logged in as they navigate a site. Personalization: They store user preferences, such as language settings, themes, or personalized dashboards, to enhance user experience. Tracking and Analytics: Websites use cookies to collect data on user behavior, such as pages visited and actions taken, helping improve website functionality and marketing strategies. Advertising: Third-party cookies track user activity across different websites to build user profiles for targeted advertising. Advanced Web Applications Security Unit I- by Aditya More 36 Cookies Types of Cookies: Session Cookies: Temporary cookies that are deleted when the browser is closed. They are used to manage a single browsing session. Persistent Cookies: Remain on your device for a set period or until manually deleted. They are used to remember login information and user preferences across sessions. Secure Cookies: Sent only over HTTPS to ensure they are encrypted during transmission. Example: When you log in to an online store, a session cookie might store your session ID to keep you logged in as you browse. A persistent cookie might remember your language preference and items in your shopping cart even after you close the browser and come back later. Advanced Web Applications Security Unit I- by Aditya More 37 Cookies Advanced Web Applications Security Unit I- by Aditya More 38 Sessions Definition: Sessions store user-specific data on the server side, associating it with a unique session ID sent to the client (usually as a cookie). Sessions are used to maintain state between the client and server during a user’s visit to a website. Purpose and Uses: User Authentication: Track and maintain user login status across multiple pages and requests. Data Persistence: Keep track of temporary data like shopping cart contents, form inputs, and user preferences during the session. State Management: Maintain consistent user experience by remembering actions taken during the session. Advanced Web Applications Security Unit I- by Aditya More 39 Sessions How It Works: Creation: When a user logs in or interacts with a website, the server creates a session and generates a unique session ID. Storage: The session ID is sent to the user's browser, usually as a cookie, while the session data is stored on the server in a database or in-memory store. Session Use: As the user navigates the site, the browser sends the session ID back to the server with each request. Expiration: Sessions typically expire after a period of inactivity or when the user logs out. The server can delete the session data once the session is terminated. Example: When you log in to a social media site, the server creates a session to track your login status and user data. As you navigate the site, the server uses your session ID to retrieve your session data, keeping you logged in and personalizing your experience. Advanced Web Applications Security Unit I- by Aditya More 40 Sessions Advanced Web Applications Security Unit I- by Aditya More 41 Tokens Definition: Tokens are secure strings of characters used for identifying and authenticating users in a web application. They are often used in stateless authentication systems, where the server does not need to store user data. Purpose and Uses: Authentication: Verify the identity of users, ensuring they are who they claim to be. Authorization: Define access rights and permissions for different resources and actions. Stateless Communication: Unlike sessions, tokens don’t require the server to store user data, making them ideal for scalable and distributed systems. Advanced Web Applications Security Unit I- by Aditya More 42 Tokens Types of Tokens: JSON Web Token (JWT): A popular token format that includes encoded information about the user and their permissions, and is digitally signed to ensure integrity. OAuth Tokens: Used in OAuth frameworks to grant limited access to user resources without sharing passwords. How It Works: Token Generation: Upon successful authentication, the server generates a token containing encoded user information and permissions. Token Transmission: The token is sent to the client, often stored in local storage or as a cookie. Token Use: The client includes the token in the Authorization header of each subsequent request. Token Validation: The server verifies the token’s signature and decodes its claims to authenticate and authorize the user. Advanced Web Applications Security Unit I- by Aditya More 43 Browser Extensions Browser extensions are small software programs that customize the browsing experience. They allow users to add functionality to their web browsers and can perform a wide range of tasks, from blocking ads to managing passwords and enhancing productivity. Key Features and Functions User Interface Enhancements: Extensions can modify the appearance and behavior of the browser interface. For example, they can add toolbars, buttons, or sidebars. Content Filtering: Extensions can block unwanted content, such as ads, pop-ups, or specific types of media. Ad blockers are a common type of content-filtering extension. Productivity Tools: Extensions can enhance productivity by adding features like task managers, note-taking apps, and integrations with other software. Privacy and Security: Many extensions focus on enhancing privacy and security. Examples include password managers, anti-tracking tools, and VPNs. Advanced Web Applications Security Unit I- by Aditya More 44 How Browser Extensions Work Components of Browser Extensions: Manifest File: A JSON file that describes the extension's name, version, permissions, and main components. Background Scripts: These run in the background, handling tasks like listening for browser events and managing the extension’s state. Think of them as the brains of the extension. Content Scripts: These are injected into web pages and interact with the content on those pages. They can modify the web page’s appearance or behavior but have limited access compared to background scripts. User Interface Elements: Pop-ups: Small windows that appear when you click the extension’s icon. Options Pages: Settings pages where users can configure the extension. Toolbars: Additional buttons or menus added to the browser. Permissions: Extensions request permissions to access certain browser features or data, which users must grant. Advanced Web Applications Security Unit I- by Aditya More 45 The Google Hacking Database The Google Hacking Database (GHDB) is a compilation of Google search queries, known as "Google dorks" or "Google hacks," which can be used to find sensitive information or vulnerabilities on websites. These queries leverage Google's advanced search operators to locate specific types of data, such as exposed files, directories, error messages, and other information that may be inadvertently indexed by search engines. The GHDB is not a standard database, but rather a knowledge repository that makes use of the power of Google’s search engine. It is made up of carefully formulated search queries, known as “dorks,” that are designed to locate specific categories of information or potential security flaws. Advanced Web Applications Security Unit I- by Aditya More 46 The Google Hacking Database- Examples 1. site: Limits search results to a specific website or domain. Example: site:example.com (Searches only within the website example.com) 2. intitle: Finds pages with specific words in the title. Example: intitle:"login page" (Finds pages with "login page" in the title) 3. inurl: Searches for URLs containing specific words. Example: inurl:admin (Finds URLs containing "admin") 4. filetype: Searches for specific file types. Example: filetype:pdf (Finds PDF files) 5. intext: Searches for specific words within the text of a page. Example: intext:"confidential" (Finds pages containing the word "confidential") Advanced Web Applications Security Unit I- by Aditya More 47 The Google Hacking Database- Examples combining queries 1. Search for pages within example.com with "login" in the title: site:example.com intitle:"login" 2. Search for PDF files containing "confidential" in the URL: inurl:pdf filetype:pdf confidential 3. Search for pages within example.com containing "password": intext:password site:example.com 4. Search for PDF files with "report" in the title: intitle:"report" filetype:pdf Advanced Web Applications Security Unit I- by Aditya More 48 Web applications vs. Cloud applications Feature Web Applications Cloud Applications Software programs that run on a web server Software services delivered over the internet, Definition and are accessed through a web browser. leveraging cloud infrastructure. Deployed on a web server and accessed via a Deployed on cloud servers and accessed via Deployment web browser. web browsers, APIs, or mobile apps. Typically hosted on a single server or data Distributed across multiple cloud servers, often Infrastructure center. utilizing virtualization and containerization. Limited scalability; scaling requires manual Highly scalable; can automatically scale Scalability intervention and hardware upgrades. resources up or down based on demand. Maintenance and updates are managed by the Managed by the cloud service provider, with Maintenance hosting provider or the developer. automatic updates and patch management. Fixed costs for server resources, with potential Pay-as-you-go pricing model, with costs based Cost for higher costs if scaling is needed. on actual resource usage. Advanced Web Applications Security Unit I- by Aditya More 49 Web applications vs. Cloud applications Feature Web Applications Cloud Applications Availability depends on the reliability of the High availability with built-in redundancy and Availability single server or data center. failover mechanisms. Data stored on a single server or a localized Data stored across multiple, geographically Data Storage data center. dispersed data centers. Cloud providers offer advanced security Security measures are implemented by the Security features, including data encryption, hosting provider or developer. compliance certifications, and access controls. Online banking sites, e-commerce websites, Google Workspace, Microsoft Office 365, Examples content management systems (CMS). Salesforce, Dropbox. Advanced Web Applications Security Unit I- by Aditya More 50 Future of web applications Progressive Web Applications (PWAs): In the future, websites will behave more like mobile apps, loading quickly and even working offline. These Progressive Web Applications (PWAs) offer a smoother experience, especially on mobile devices, providing users with fast access to content and features without the need to install anything. AI and Machine Learning Integration: Websites will increasingly use smart technology like AI and machine learning to understand users better. This means they can personalize content, recommend products, and automate tasks like customer support. By integrating AI, websites aim to provide more tailored and efficient experiences for users. Advanced Web Applications Security Unit I- by Aditya More 51 Future of web applications Better User Experience (UX): The focus will be on improving user experience by making websites faster, smoother, and more engaging. This includes using animations, intuitive navigation, and faster loading times to create websites that are easy and enjoyable to use, keeping users satisfied and coming back. Internet of Things (IoT) Integration: Websites will connect with smart devices like home gadgets and wearables, allowing users to control and monitor them from the web. Integrating IoT into websites aims to make managing smart devices more convenient and accessible for users from anywhere. Voice Interfaces and Natural Language Processing (NLP): Websites will become more voice-friendly, understanding and responding to voice commands. This means users can interact with websites using their voice, making navigation and interaction easier, especially for those who prefer hands-free operation. Advanced Web Applications Security Unit I- by Aditya More 52 Future of web applications Cross-Platform Development: Websites will be designed to work seamlessly across different devices without needing separate versions. This ensures that users get a consistent experience whether they're using a phone, tablet, or computer, making access easier and more uniform. Serverless Architecture: Building websites will become easier with serverless architecture, where developers don't have to worry about managing servers. Websites built this way can scale automatically to handle varying levels of traffic, making development more efficient and cost-effective. Advanced Web Applications Security Unit I- by Aditya More 53