Web & Security Mind Map

Every web & security visualization on this site on one map. The branches are the main ideas. Each leaf is a page; the grey line under it is the one thing to remember about it. Click a branch to focus on it, click a page to open it.

Recall mode hides the page names. Read the hint, say the name, then click the "?" to check.

1. How the map is organized

Overview of the web & security mind map: Crypto building blocks, Storing passwords, Browser rules, Request attacks, Login & identity, OWASP Top 10 2025, OWASP: supply chain & ops. — The map at a glance: 7 branches, 29 pages.

Ask what is being protected, and where:

Is it the math itself? Keys, ciphers, hashes and signatures are crypto building blocks; using them to keep a leaked password database safe is storing passwords.
Is it about what the browser sends or lets a page read? Cookie flags and CORS are browser rules; attacks that abuse them or trust user input (CSRF, XSS, SSRF) are request attacks.
Is it about who the user or service is? Tokens, tickets, passkeys and client certificates are login & identity.
The two OWASP branches are a checklist view: each page shows one class of real-world mistake and its fix. Flaws in the code itself go under OWASP Top 10; dependencies, logging and error handling go under supply chain & ops.

2. The branches side by side

Branch	Protects	Main tools	Typical mistake
Crypto building blocks	secrecy and integrity	AES, RSA, Diffie-Hellman, SHA-256	ECB mode, home-made crypto
Storing passwords	a leaked database	Argon2id or bcrypt with a salt	fast unsalted hash like MD5
Browser rules	data of each site	SameSite, HttpOnly, CORS	reflecting any Origin in CORS
Request attacks	users and the internal network	encoding, CSP, CSRF tokens, allowlists	trusting input
Login & identity	accounts and services	OAuth, passkeys, Kerberos, mTLS	long-lived tokens with no revocation
OWASP Top 10	the whole app	safe defaults, checks on the server	trusting the client
OWASP: supply chain & ops	builds and incident response	lockfile hashes, SBOM, alerts	fail-open error handling

3. Five facts to remember

Hashing is one-way; encryption can be undone by anyone with the key.
Asymmetric crypto is slow, so real systems use it only to agree on a symmetric session key (hybrid encryption).
Store passwords with a slow, salted hash such as Argon2id or bcrypt, never plain MD5 or SHA-256.
The same-origin policy stops a page reading other sites' responses, not sending requests: that is why CSRF needs SameSite or tokens.
Never trust the client: check prices, permissions and try limits on the server.

See all web & security pages in the index, or the other mind maps.