Analysis of current threats and security measures used in web applications on the example of Symfony, Express, and Spring Boot

The article analyzes the most common threats currently appearing in web applications and compares the built-in security features of Symfony, Express, and Spring Boot frameworks. The study aimed to identify security gaps, assess their risk, and then present practices that enable effectiveprotection against attacks. The priority was to create four applications that were all identical in terms of structure. Tested applications were designed to have built-in security mechanisms from analyzed threats. The greatest threats currently are Broken Access Control attacks, cryptographic vulnerabilities, and code injection. The research process was conducted using Burp Suite Professional, SQLMap, XSSER, andHydra tools. The results indicate that Symfony and Spring Boot are the best protected against the threats. Additionally, the default Expressskeleton mechanisms do not protect the application from Cross Site Scripting (XSS) attacks.