What you’ll be able to do
- Name the client and the server as separate trust zones for one TrackPort request.
- Explain what a valid TLS session does not decide about identity, authorization, or the honesty of page script.
- Describe injection and a broken access check as integrity or confidentiality losses, not as a product category.
- Decide whether a third-party checkout script belongs on a payment page before it ships.
The browser is a client, not a second copy of the server
TrackPort’s page runs in a customer’s browser. The shipment rules run on Riverstone’s server. That line is an application trust boundary. The browser can show a button, hide a field, or skip a script. The server still has to decide whether this identity may read shipment 8821. Least privilege from the previous lesson is the same sentence here: subject, action, object, and condition, checked where the data actually lives.
A green padlock means Transport Layer Security (TLS) protected the bytes and checked a certificate name. It does not decide which person is at the keyboard, which shipments they may see, or whether a script on the page is allowed to read the form. F3 traced the request. This lesson asks who is allowed to mean something after the request arrives.
Injection and broken access checks are losses, not a poster
If TrackPort builds a query by gluing a search box into a database command, an unexpected string can change the command. That is an integrity loss of the query, and it can become a confidentiality loss if the changed command returns other customers’ addresses. If the server checks the button in the browser but returns the export anyway when the API is called directly, authorization failed. The account may be authenticated and still must not receive the file.
The OWASP Top 10 is a short awareness list of widely seen web risks, including injection and broken access control. It is a conversation starter for TrackPort, not a test you can finish by ticking ten boxes, and not a certification. Use the framework card when you need the edition and the limits. Then write the loss: which asset, which property, which boundary failed.
- Client: display, input, and script. Treat it as untrusted.
- Server: authentication result, authorization, and stored records.
- TLS: confidentiality and integrity of the bytes, plus a name check.
- OWASP Top 10: shared names for awareness, not the whole test plan.
Worked decision: a script on the checkout page
Retail partners sometimes ask Riverstone to drop a “delivery tips” script on the TrackPort page that sits beside card entry. The card fields live in the payment provider’s frame. Marketing says the frame means the surrounding page cannot matter. Maya maps the boundary: the script runs in the customer’s browser, on Riverstone’s page, beside the payment frame. It can read or change what the customer sees before the provider ever gets the card. TLS still protects the trip to Riverstone. It does not review the script.
The useful decision is small. Keep an inventory of scripts, the page they were approved for, and who can publish them. A catalogue-only tag that also runs on checkout has crossed a boundary. Preserve the change, then ask the page owner and the payment owner whether that script is allowed there. A successful test payment does not answer the question.
CHECK YOUR JUDGMENT
A partner wants a third-party script on the TrackPort checkout page “for tips.” Card fields sit in the payment provider’s frame, and a test purchase succeeds. What should Maya decide?
NEXT FIELD LESSON