Web › Module 10 › Lesson 3
Unexpected States and Recovery
Partial writes, retries, and poison states — recover without skipping controls.
Visual · unexpected_states_recovery
State machine with a rollback arrow. — router STOP — SAFE Own apps — no chaos against foreign prod.
Opening
Recovery that skips authz or integrity checks is just fail-open with better marketing.
OWASP Top 10:2025 A10 Mishandling of Exceptional Conditions includes unsafe recovery: retries that double-charge, compensating transactions that grant privileges, startup that continues after failed secret load, and “repair” jobs that bypass validation. Attacker goal: push the system into a state where controls are skipped. Cyberlium: design recovery on apps YOU own — 0.0.1:8775. Not chaos-engineering someone else’s production without RoE. Next: exception handling review lab. Today: states and recovery.
1. Partial failure: make effects idempotent or transactional
If step 1 commits and step 2 throws, define rollback or compensating action that preserves invariants (A06 carry). Idempotency keys prevent double apply on retry. Document for one workflow YOU own.
Poison messages in queues need quarantine + alert (A09), not infinite retry storms that amplify load.
Command guide
A10 Exceptions — Partial failure
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ COMMANDS ═══
Command — copy this
SAFE="http://127.0.0.1:8775"
Command — copy this
curl -sS -m 3 -I "$SAFE/" | head -n 12
2. Startup and dependency failure: refuse unsafe boot
If TLS keys, HMAC secrets, or policy files fail to load, fail closed: do not start serving with empty defaults. “Start anyway with allow-all” is A10. Health checks should distinguish “up but unsafe.” The 8775 toy’s /health?secrets=missing refuses to claim healthy.
Feature flags that disable security “during incidents” need dual control and expiry — write that policy.
Command guide
A10 Exceptions — Startup and dependency failure
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ COMMANDS ═══
Command — copy this
SAFE="http://127.0.0.1:8775"
Command — copy this
curl -sS -m 3 -D - "$SAFE/health?secrets=missing" | head -n 20
3. Repair tooling: still authenticate and authorize
Admin repair CLIs are privileged. They need authn, authz, audit logs, and change tickets on systems you administer. A recovery script that hardcodes bypass tokens in the repo fails A07 and A10 together.
Do not run repair tools against foreign tenants or the home router.
4. Chaos only where you have permission
Game days on YOUR staging are fine when scoped. Randomly killing café POS processes is not a lab. Hydra on 192.168.0.1 is not a lab. Cite A10. Original Cyberlium — not official OWASP certification.
chmod 600 notes.
5. Wrong vs right: bypass recovery vs controlled rollback
Same word “recover,” opposite control.
Wrong
Boot with empty secrets allow-all. Retry without idempotency. Chaos foreign prod. Repair without audit. Hydra the router. nmap the LAN.
Right
Identify DEMO; router → SAFE. Transactional/idempotent recovery; refuse unsafe boot; audited repair; lock recovery-notes.txt. Next: Lab — Exception Handling Review.
6. Hands-on: identify + /health refuse + recovery-notes.txt
Start the 8775 toy (reuse L01/L02 process or a10_recovery_toy.py). GET /health?secrets=missing should not advertise allow-all. Fill recovery policy for one workflow you own.
Mission: recovery-notes.txt (mode 600)
1) 0.0.1:8775 after starting a10_recovery_toy.py.2) Curl /health vs /health?secrets=missing. Document partial-failure and boot policies; note repair-tool authz/audit. 3) chmod 600 $HOME/cyberlium-lab/recovery-notes.txt. No foreign chaos. No hydra. No nmap.
Stuck? Ask Cyberlium AI Mentor
If recovery still means “turn security off,” ask for a hint. Try: "Hint only: idempotent retry vs allow-all; why refuse boot without secrets; why 192.168.0.1 router login is OUT OF SCOPE; where notes live?"
Safe recovery keeps invariants and controls intact. A10. Original Cyberlium — not official OWASP certification. Next — Lab — Exception Handling Review.
Knowledge Check
APPLY: Secret load fails; app starts with allow-all authz. A10?
Multiple choice
Knowledge Check
APPLY: True or False: Retries without idempotency can create duplicate side effects.
True or False
Knowledge Check
APPLY: curl of http://192.168.0.1/ is router admin. Chaos it for recovery practice?
Multiple choice