A Comprehensive Review on Full-Stack Development in the Cloud Era: Trends, Tools, and Best Practices

The article discusses key issues of web application security and methods of protection against hacker attacks. With businesses increasingly dependent on online services, web application security is becoming one of the top priorities for organizations. Sufficient attention should be paid to security measures to protect user data from unwanted access and malicious use. This article reviewed the main types of hacker attacks on web applications, such as SQL injection (SQLi), Cross-site scripting (XSS), Cross-site request forgery (CSRF), Server-side request forgery (SSRF) and file attacks, as well as examples of protection measures against each type of attacks. Updated and improved basic principles of web application security are proposed based on threat modeling techniques.

The present research focuses on the security of Macedonian websites. It involves the analysis of HTTP Security header responses for 756 websites in the country, of which 246 are the most popular. This analysis is conducted across 13 different categories of websites, including government bodies and institutions, public institutions and enterprises, educational, commercial, news and media, entertainment, sports, etc. We intend to create a comprehensive security profile for the country's websites, which will help raise their overall security level. It is critical to understand and implement proper HTTP security headers to prevent or limit the dangers that can cause website attacks such as Denial of Service (DoS), Cross-Site Scripting (XSS), Cross-Site Request Forgery (CSRF), SQL Injection, clickjacking, etc. Our analysis was performed with the help of the Mozilla Observatory tool. We have discovered a significant lack of implementation and/or misconfiguration of HTTP security headers in all categories. Almost half of the websites (n=375; 49.60\%) have an F grade, while more than a quarter of all websites (n=214; 28.31\%) have a minimal security score of 0.

With the rise of the web as a dominant application platform, web security vulnerabilities are of increasing concern. Ideally, the web application development process would detect and correct these vulnerabilities before they are released to the public. This research aims to quantify the effectiveness of software developers at security code review as well as determine the variation in effectiveness among web developers. We hired 30 developers to conduct a manual code review of a small web application. The web application supplied to developers had seven known vulnerabilities, including three different types: Cross-Site Scripting, Cross-Site Request Forgery, and SQL Injection. Our findings include: (1) none of the subjects found all confirmed vulnerabilities, (2) more experience does not necessarily mean that the reviewer will be more accurate or effective, and (3) reports of false vulnerabilities were significantly correlated with reports of valid vulnerabilities.

With the increasing reliance on web applications for business and personal use, ensuring website security has become a critical concern. Cyber threats such as SQL injection, cross-site scripting (XSS), malware infections, and unauthorized access pose significant risks to websites, leading to data breaches and service disruptions. This project aims to develop a comprehensive website security scanner that systematically identifies vulnerabilities and potential security risks.The proposed system integrates automated vulnerability scanning, penetration testing techniques, and real-time monitoring to detect security loopholes. Using machine learning and heuristic-based analysis, the scanner can identify malicious scripts, outdated software versions, weak authentication mechanisms, and misconfigured security policies. The system also performs network security assessments, analyzing potential DDoS (Distributed Denial-of-Service) attack risks and firewall configurations. The scanner generates detailed security reports, providing actionable insights and recommendations for website owners and administrators to mitigate risks effectively. Designed for continuous monitoring and proactive defense, the tool enhances cybersecurity resilience against evolving threats. This project contributes to web security advancements by offering an intelligent, automated, and scalable solution for safeguarding websites from cyberattacks. Keywords: Website Security | Vulnerability Scanner | Cyber Threats | SQL Injection | Cross-Site Scripting (XSS) | Penetration Testing | Machine Learning | Malware Detection | DDoS Protection | Authentication Security | Firewall Analysis | Web Application Security | Risk Assessment | Cybersecurity Resilience

The article analyzes current trends in the use of unique identifiers of the UUID (Universal Unique Identifier) type in databases for creating key records. It highlights areas of application of such identifiers in software systems across various domains and identifies relevant challenges related to their use in the context of modern data security requirements. The advantages of ULID (Universally Unique Lexicographically Sortable Identifier)—next-generation identifiers distinguished by higher performance and the ability to support lexicographical sorting through a monotonic generation principle—are examined. Based on an analysis of modern data protection needs, it is concluded that UUID-based identifiers require a high level of security, particularly against SQL (Structured Query Language), XSS (Cross-Site Scripting), CSRF (Cross-Site Request Forgery), and Insecure Direct Object Reference (IDOR) attacks. It is emphasized that protection methods must consider the specifics of the data types on which key identifiers are built. As an extension of security tools, a method for converting UUIDs into a graphical form visually resembling a unique chart is proposed. An algorithm and a diagram for determining the coordinates of UUID and ULID are developed, with an example of transformation and visual representation provided. The forms and areas of application of the proposed method are discussed, including the possibility of reverse conversion for integrity verification, masking in client–server interactions, data reconciliation, and recovery after attacks or failures. The use of both the graphical image itself and the coordinate array that forms it is described. Approaches to encoding and encrypting coordinate data at the stage of chart generation and rendering are proposed. The method enables concealing an identifier in graphical form, which complicates its identification during unauthorized access (for example, in the case of cookie theft) and can also serve as a graphical hash. A combined method of application in web systems is proposed: encrypted coordinates generated by this method are stored in a hidden field of the client form and verified on the server based on session data. This approach ensures identifier authenticity verification (protection against IDOR) while simultaneously functioning as an anti-CSRF token. In the field of data storage, approaches are proposed for applying the method to integrity verification and data recovery after security incidents without the immediate need to restore backup copies. The proposed conversion method can be implemented either as a graphical hash or as a protected copy. It allows operations with both the graphical image and the coordinate array in a format that is more secure compared to symbolic representation. The method has several advantages over QR codes: unlike the latter, the structure of the graphical hash is not standardized and therefore can only be decoded by a server possessing the generation parameters and decoding algorithm, while also providing the possibility of visual output. The proposed UUID-to-graph conversion method can help address several applied problems and enhance tools for ensuring data security and confidentiality across all areas where such identifiers are used.

: This research paper focuses on the topic of data security and data breaches specifically in web applications. As more businesses and organizations move their operations online, web applications have become a prime target for cyber attacks. This paper examines common vulnerabilities in web applications such as SQL injection, cross-site scripting, and insecure session management and how they can be exploited to gain unauthorized access to sensitive data. Venmo, a popular peer-to-peer mobile payment app, has faced several data breaches in recent years, raising concerns about the safety of user information. This research paper will also examine the causes and consequences of these data breaches and discusses best practices for secure web application development.

The increasing complexity and sophistication of web-based applications have made them vulnerable to various security threats. Web Application Firewalls (WAFs) have emerged as an essential security measure to protect web applications from common attacks such as SQL injection, cross-site scripting (XSS), and others. This research paper explores the techniques and challenges involved in controlling web traffic using a Web Application Firewall. The paper discusses the working principles of WAFs, the various methods employed to analyze and filter web traffic, and the effectiveness of these techniques in mitigating different types of attacks. Additionally, the paper highlights the challenges faced in deploying and managing WAFs and provides insights into potential future developments in the field. This research paper delves into the techniques and challenges associated with controlling web traffic using a Web Application Firewall. It explores the fundamental principles of WAFs, including signature-based filtering, behavior-based analysis, whitelisting, blacklisting, rate limiting, and protection against common vulnerabilities. The paper evaluates the effectiveness of these techniques in mitigating various attacks and highlights the challenges involved in deploying and managing WAFs, such as configuration complexity, false positives and negatives, performance impact, and integration with existing security infrastructure. Furthermore, the paper discusses emerging trends and potential future directions in the field, including the integration of machine learning and artificial intelligence, advanced behavioral analysis techniques, and cloud-based architectures.

Currently, websites are widely used in various fields, including government. However, government websites are often the target of hacking. The XY Regency Communication and Information Agency experienced a website breach in 2023, which affected one of its subdomains, e-office.xy-regency.go.id, which stored employee data. This hack resulted in the leakage of sensitive data, user account takeovers, service disruptions, and a decline in public trust. The purpose of this study was to identify and test the vulnerabilities of the e-office.xy-regency.go.id website using the NIST SP 800-115 method, which includes the planning, discovery, attack, and reporting phases. Vulnerabilities were classified using the Common Vulnerability Scoring System (CVSS) and the OWASP Top 10 standard. This study identified two high-level vulnerabilities, namely Cross-Site Scripting (XSS) with a CVSS score of 8.2, classified as High severity, and Cross-Site Request Forgery (CSRF) with a CVSS score of 9.3, classified as Critical severity. These vulnerabilities could allow hackers to execute malicious scripts and manipulate users without their knowledge. Recommendations include implementing input validation on text boxes by limiting characters to letters or combinations of letters and numbers, and ensuring that all forms and endpoints that handle sensitive data are protected with unique and unpredictable CSRF tokens. Future research should focus on analyzing domain vulnerabilities, identifying the origin and potential of attacks, and developing effective protection and recovery strategies.

The rapid adoption of DevOps practices has transformed the software development landscape by emphasizing continuous integration, continuous delivery (CI/CD), and agile methodologies. However, this rapid pace of development often introduces significant security challenges, as traditional security testing methods struggle to keep up with the accelerated release cycles. To address these challenges, the integration of Artificial Intelligence (AI) and Machine Learning (ML) into automated security testing has emerged as a promising solution. This paper explores the use of AI and ML to enhance automated security testing within DevOps environments, offering a comprehensive approach to identifying, predicting, and mitigating security vulnerabilities in real time. Automated security testing leverages AI and ML algorithms to analyze code, detect anomalies, and predict potential security threats. These technologies enable the continuous monitoring of codebases, allowing for the early identification of vulnerabilities before they are exploited. By incorporating AI-driven security testing into the CI/CD pipeline, organizations can ensure that security is not an afterthought but a continuous process integrated into every stage of the software development lifecycle. AI and ML models can be trained to recognize patterns associated with security risks, such as code injection, unauthorized access, and data leakage. These models continuously learn from new data, improving their accuracy over time and adapting to evolving threats. The dynamic nature of AI-driven security testing makes it particularly suited for DevOps environments, where frequent code changes and updates can introduce new vulnerabilities. Moreover, AI and ML can assist in automating complex tasks, such as threat modeling, risk assessment, and the prioritization of security issues, enabling security teams to focus on higher-order tasks that require human expertise.

To facilitate the detection of various vulnerabilities, there are many different tools (scanners) that can help analyze the security of web applications and facilitate the development of their protection. But these tools for the most part can only identify problems, and they are not capable of fixing them. Therefore, the knowledge of the security developer is a key factor in building a secure Web resource. To resolve application security problems, developers must know all the ways and vectors of various attacks in order to be able to develop various protection mechanisms. This review discusses two of the most dangerous vulnerabilities in the field of Web technologies: SQL injections and XSS attacks (cross-site scripting – XSS), as well as specific cases and examples of their application, as well as various approaches to identifying vulnerabilities in applications and threat prevention. Cross-site scripting as well as SQL-injection attacks are related to validating input data. The mechanisms of these attacks are very similar, but in the XSS attacks the user is the victim, and in the SQL injection attacks, the database server of the Web application. In XSS attacks, malicious content is delivered to users by means of a client-side programming language such as JavaScript, while using SQL injection, the SQL database query language is used. At the same time, XSS attacks, unlike SQL injections, harm only the client side leaving the application server operational. Developers should develop security for both server components and the client part of the web application.

The digital landscape continues to evolve; ensuring robust internet safety has become a critical challenge in the face of growing cyber threats. This chapter delves into the transformative potential of artificial intelligence (AI) and blockchain technology in reinforcing cybersecurity measures. AI's ability to analyze large-scale data, identify patterns, and predict potential vulnerabilities makes it an invaluable tool in enhancing security protocols. When combined with blockchain's decentralized and immutable nature, which secures data by providing an incorruptible ledger, these technologies collectively offer an advanced framework for real-time threat detection and mitigation. The chapter explores several key applications, including decentralized identity management, cyber fraud detection, and privacy protection, illustrating how the fusion of AI and blockchain can help address significant security concerns such as data breaches, identity theft, and unauthorized access. However, the integration of AI and blockchain into cybersecurity systems is not without challenges. Issues such as scalability, energy efficiency, and the technical complexity of merging these technologies in practical settings remain obstacles. Despite these hurdles, significant advancements in blockchain protocols, such as sharding and AI-based optimization algorithms, show promise in overcoming these limitations through case studies and recent developments; this chapter demonstrates how AI and blockchain can work together to create a more secure, resilient, and transparent digital environment. This chapter is merely focused on the various technology aspects to secure date through various AI and blockchain techniques.

This capstone project shows the creation and implementation of a virtual environment for the use of penetration testing. This aims to identify vulnerabilities within IT in- frastructure. With a world that is heavily reliant on digital systems, the cybersecurity threats are evolving at a rapid pace which highlights the necessary measurements needed for effective security measures. This project showcases the challenges that are faced by organizations using outdated systems with unpatched vulnerabilities. This exposes them to potential data breaches and substantial financial losses as well as reputational damage.The virtual lab replicates a corporate IT infrastructure with different operating systems including windows, Linux, android as well as web application and network configurations. using both internal and external penetration testing, this is targeting vulnerabilities such as SQL injection, cross-site scripting (XSS), privilege escalation etc. Tools like SQLMap, Metasploit and others are used to simulate real-world attack scenarios. Each one thoroughly documented, a detailed analysis will provide insight into potential exploitation and mitigation strategies.The outcome of this project will include identifying critical security flaws and offering recommendations to enhance security. In addition, this project gives an educational standpoint onto showcasing the value of pen testing, or ethical hacking in the practices of today’s cyber security. These findings showcase how the need for penetration testing will give organizations a framework to protect against threats effectively.For future work, this will involve expanding the lab for more modern threats as they are evolving, as well as introducing more automated penetration testing processes to ease the workload and to keep up with the expanding of IoT’s, In addition this project contributes to the broader field of cybersecurity by giving a more clear understanding Aswell as implementation of practical security measures in the world, specifically IT environments.

Personalized nutrition (PN) aims to provide tailored dietary recommendations to improve a person's health outcomes by integrating a multitude of individual-level information and supporting desired behavior changes. The field is rapidly evolving with technological advances. As new biomarkers are discovered, wearables and other devices can now provide up-to-the-minute insights, and artificial intelligence and machine learning models support recommendations and lifestyle behavior change. Advancements in the field enhance the potential for tailored and effective programs but raise important questions regarding user safety, security, health, transparency, and privacy. The Personalized Nutrition Initiative at the University of Illinois held the workshop, "Challenges for Personalized Nutrition in the Current United States Regulatory Framework and Future Opportunities," to address regulatory implications of current PN programs, future innovation within the current framework, and existing complexities of oversight. A majority of PN programs combine multiple components, and these components may need to be regulated differently. The areas of food, supplements, in vitro diagnostics, and medical and wellness devices were described and discussed as they apply to PN programs. The speakers and discussants concluded that regulatory guidance for PN programs should focus on ensuring 1) safety and accuracy of the tests and devices, 2) credentialed and skilled experts develop the advice, 3) responsible and clear communication of information and benefits, 4) substantiation of scientific claims, and 5) procedures are implemented to protect user privacy. Furthermore, as this field incorporates new devices, biomarkers, behavior-based tools, and the integration of artificial intelligence and machine learning, the need to adapt the existing regulatory framework was also considered. Working closely with regulatory bodies is required and should be an opportunity to provide users with transparency, build trust, and create a source of differentiation for PN innovators.

In modern web applications, token-based authentication has become a crucial mechanism for securing access to protected resources. JSON Web Tokens (JWTs), in particular, are widely adopted due to their stateless and scalable nature. However, this reliance makes tokens a prime target for attackers, with incidents of token theft and misuse via techniques such as Cross-Site Scripting (XSS), Cross-Site Request Forgery (CSRF), and token hijacking on the rise. Existing security solutions like IDS and application firewalls are not designed to effectively detect token-specific attack patterns, leaving a critical security gap in modern authentication systems. To address this problem, we propose a Token-based Authentication Monitoring System capable of detecting, tracking, analyzing, and investigating suspicious token behaviors in real time. Our research focuses on JWT-based access tokens and the refresh token technique in OAuth 2.0 environments. A core contribution of this work is the design of 25 specialized detection rules based on patterns. We validated the proposed system through 70 comprehensive test cases covering both normal and attack scenarios. The system achieved an overall detection accuracy of 81.4%, demonstrating its capability to effectively detect token-related attacks overlooked by conventional defenses. Additionally, we evaluated the system’s performance, measuring detection latency and operational overhead in a real-world integration scenario. The results confirmed that the monitoring system delivers real-time detection with minimal impact on application responsiveness and system resources. This research offers a practical, adaptable framework that enhances the security of any system employing token-based authentication, reducing the risk of unauthorized access while maintaining system performance.

World Wide Web (WWW) has been introduced in 1980s and is widely been used until today. With WWW service, publisher able to host a website in form of hypertext using Hypertext Mark-up Language (HTML). In addition, Cascading Stylesheet (CSS) is always used with HTML to manage the layout of the webpage. Over the years, the capability of HTML and CSS is getting enhanced to create a more responsive webpage. However, all these webpages creation is more towards information sharing and does not really handle user inputs. Hence, in this project, the security measures are proposed to counter these threats will be compiled as a library to be usable in any PHP-based web application. A basic but fully functional e-commerce application is developed for the testing of the proposed security features to countermeasures the mentioned vulnerabilities.