Exploring Basics and Best Practices of Server-Side Template Injection (SSTI) Vulnerability

Why do we need Server-Side templates?

Let’s consider a scenario where a developer would like to display a custom error message instead of a generic error when a user attempts to access a non-existent web page. In general, the developer might have to create separate pages for each error message, but this can be simplified incase if we leverage server-side templates. With server-side templates, the developer can easily separate the code that decides the error message from the code that …

access application security basics best practices developer display error general injection message non owasp page practices scenario server ssti template template injection vulnerability web web application security web development