What I Learned About Web Application Security: Threat Modelling a PHP Invoice Application

I'm currently developing my skills in software engineering, networking and cybersecurity. As part of my learning journey, I recently completed a practical threat-modelling exercise using a PHP/MySQL invoice application as a case study.
The goal wasn't simply to learn security terminology. It was to understand how attackers might target a web application and how developers can reduce those risks.

1. Identifying potential threats
Brute-force attacks
An attacker repeatedly attempts different passwords to compromise an administrator account.
Potential defence: Login rate limiting, progressive delays and monitoring.
SQL injection
An attacker manipulates application input to interfere with database queries.
Potential defence: Prepared SQL statements and appropriate database permissions.
Broken access control
An unauthenticated user attempts to access protected pages, such as an administrator dashboard.
Potential defence: Server-side session checks and authorization on every protected resource.
Session hijacking
An attacker obtains an administrator's active session cookie and attempts to impersonate that administrator.
Potential defence: HTTPS, secure cookie attributes, session expiration and proper session management.

2. Understanding browser cookie security
I studied three important cookie attributes:
• HttpOnly: Prevents JavaScript from directly reading the cookie.
• Secure: Restricts cookie transmission to HTTPS.
• SameSite: Helps mitigate cross-site request forgery (CSRF).
One particularly important lesson was that HttpOnly does not completely prevent session abuse.
A browser can automatically attach eligible session cookies to requests. Therefore, malicious JavaScript running in an application's origin may still perform actions using the authenticated browser session, even when it cannot directly read the cookie.
This helped me understand why preventing XSS and securing sessions must work together.

3. Key lessons

1. Authentication and authorization are different security concepts.
2. Server-side validation is essential.
3. Prepared statements help prevent SQL injection.
4. Rate limiting helps reduce brute-force attacks.
5. Cookie security requires multiple defensive layers.
6. XSS can remain dangerous even when session cookies use HttpOnly.

4. What comes next?
My next step is to move beyond theoretical threat modelling and examine how these protections can be implemented and tested in a PHP application.
I'm documenting each completed exercise as part of my journey towards becoming a stronger software engineer with practical cybersecurity knowledge.
Question for the community:
What's one web application security mistake you commonly see beginner developers make?