Fix Patterns Before Payloads

Validation means the server decides what a field is allowed to be before it uses it: this id is an integer in range; this slug matches a small regex; this enum is one of the values you defined; this file is a size and type you accept. Allowlist first (what may pass), not a denylist of “naughty characters” you saw on a blog. Attackers change encodings. Your code should accept known-good. HTML required= and a JavaScript length check are user experience. Anyone can send a raw HTTP request. If the handler trusts the browser, the handler has no validation. Module 10’s rate limits are a cousin on expensive paths (login, search, export) — still a server policy, still not a bypass homework.

Validation is not a substitute for parameterized queries. Checking that a username “looks like a username” does not make string-built SQL safe. Module 15 exists because concatenation turns the query into attacker-controlled text. Topic 10’s prevention lessons are the deep path. This lesson only needs the order: validate for your domain rules, then use safe APIs for SQL and for command execution (do not shell out on input). No cheat sheet of unions belongs in these notes.

sudo apt install python3

brew install python3

python3 - << 'PY'
allowed = {'WIDGET','GADGET'}
client = 'WIDGET'
print('allowlist_ok', client in allowed)
print('client_html_required_field: not a control')
PY

Encoding means when you write untrusted text into HTML, an attribute, a URL, or a JavaScript string, you use the encoder for that context so a name stays a name. The builder pattern is “encode at the boundary you emit,” not “hope the database ate the angle brackets.” Topic 10’s XSS module teaches types (reflected, stored, DOM) and prevention on Cyberlium’s own labs. This course will not paste alert-boxes or filter-bypass lists. Naming the pattern is enough for Module 14: output encoding is how you keep the session lane from becoming a script lane. Content-Security-Policy is a defense-in-depth header (Topic 10 again), not a reason to skip encoding.

Wrong instinct: “if I find a place the encoder missed, I am doing CEH.” Finding that place on an app you do not own is unauthorized testing. Finding it on YOUR app is a ticket: which template, which context, which encoder. Lesson 2 already gated hosts. Keep the instinct pointed at code you maintain.

sudo apt install python3

brew install python3

python3 - << 'PY'
import html
print(html.escape('<b>stay data</b>'))
print('context_matters: HTML vs JS vs URL — still no payload pack')
PY

Authentication answers who. Authorization answers whether that who may do this. The server must load the object, check the principal, and allow or deny — on GET and on POST, on the JSON API and on the export job. A common failure has a name you will meet in Topic 10 as IDOR (insecure direct object reference): the URL or body carries an id, and the handler returns the row without asking whether this session owns it. The fix pattern is not “obscure the id.” The fix is an ownership or role check on the server every time. Client-side “if role === admin show button” is decoration. A hidden form field named isAdmin is input, not a verdict.

Session flags from Module 11 (Secure, HttpOnly, SameSite on cookies; HTTPS on the wire) protect the proof of identity. They do not replace object-level checks. A stolen-or-guessed id with a valid session that belongs to someone else is still an authZ bug. Rate limits (Module 10) and MFA (authentication lane) do not patch missing authZ. Write the check next to the query that loads the row. Deny by default. Log denials without leaking whether the object exists if that would be a side channel you care about — a design note, not an evasion lab.

sudo apt install python3

brew install python3

cat >> "$NOTES" << 'EOF'
hide_url: not authorization
check: every object, every action
EOF

A fix-pattern note is a review checklist. Date (UTC). Labeled app YOU own or a hypothetical you would own (not school.edu). Validation: which fields, allowlist rules, server-side. Encoding: which templates emit untrusted text, which context. AuthZ: which objects re-check ownership/role on the server. Pointer: SQLi parameterized queries → Module 15; XSS encoding labs → Topic 10; no payloads in this file. Ethics: no bypass kit, no random site, no public DVWA. Legal line: original Cyberlium teaching mapped to the CEH v13 web-applications domain — not official EC-Council training, not a cert, not exam dumps. File: $HOME/cyberlium-lab/fix-patterns-notes.txt, chmod 600.

Do not add a chapter titled “how I would beat the validator.” Do not paste encoder bypasses. Next lesson maps routes so the authn/authz column is visible — still YOUR project or 127.0.0.1.

On a computer you own, create cyberlium-lab if needed. Fill the three patterns for a labeled app you own or would own. chmod 600. The block writes notes only — no client aimed at the internet, no payload list.

cd "$HOME/cyberlium-lab"

{

You now treat application methodology as three server-side patterns — validate, encode, authorize — written for code you own. Payloads stay out; Topic 10 and Module 15 hold injection/XSS depth. Notes are locked in cyberlium-lab. This is original Cyberlium teaching mapped to the CEH v13 web-applications domain — not official EC-Council training, not a cert, not exam dumps. Next — Lab — Map Routes on an App You Own — list URLs and auth requirements for YOUR project or a local demo, app-route-map.txt chmod 600.