HARBOR DESK / 02 / PRACTICE GUIDE
Web application security testing
Test browser behavior, server sessions and file-processing boundaries together. Distinguish scanner output from a validated finding.
Download guide and workpapersOriginal AI-assisted SecNet educational content; examples are fictional. Not a source organization publication or endorsement. Sources checked: 2026-10-21.
CODE REVIEW DESK
See the decision through the test.
Code here is a local policy model with no target connection. Passing model cases are not security approval or device tests.
Session revocation / Weak code
Inspect an incomplete decision based on record existence or another positive signal. Consider denial cases alongside permitted use.
s=>Boolean(s.cookie||s.queryToken)A URL token or old cookie cannot replace a valid server session. The model denies a revoked session. It does not implement token signatures or actual browser cookie policy; those require integration tests.
Choices and outputs last only on this open page; they do not update account progress, career status, points or certificates.
01 / EXPLANATION
Scope and session lifecycle
Test authorization should identify the environment, accounts, data boundary, window and stop contact. URL tokens may reach history, logs and referrers. Cookie presence alone is insufficient: the server session must be active and unexpired. Retry with the old session after logout and record behavior across tabs and concurrent sessions.
02 / EXPLANATION
CSRF and content boundaries
Do not design state-changing GET requests. For cookie sessions, assess SameSite alongside method, exact origin and CSRF checks. CORS is not authorization. For uploads, neither extension nor the client Content-Type is authoritative; bound size, decode the actual format with a controlled parser, and separate serving from the application origin.
03 / EXPLANATION
From finding to retest
A finding needs prerequisites, minimal reproduction, expected/actual behavior and business impact. Redact sample data and exclude live session material. After correction, rerun the original case, a nearby negative variant and the legitimate workflow. WSTG 4.2 is the stable testing guide; ASVS 5.0 supports verification requirements. Automated scanning does not cover either in full.
04 / EXPLANATION
Worked example: a denied mutation
The local HTTP test establishes a valid fictional session, then sends PATCH with a wrong origin and a wrong CSRF value. Both must return 403, and a later read must show the original title and version. Correct CSRF cannot authorize another user’s record: the object boundary still applies. Try normal use in the browser and inspect denials and body limits in the automated tests. There is no upload endpoint in this fixture; its upload policy model prepares you to examine an actual parser. Treat scanner alerts as candidates until minimal reproduction and data invariants are demonstrated within scope.
Build the evidence yourself.
Blank workpapers are not completed tests. Fill them in your authorized environment without secrets or real personal data.
Full guide with code, outputs and reasoning ↓Primary references
Explanations are authored by SecNet. References support method and platform context; verify current editions and organizational policy for real use.