Explore JavaScript web application security to mitigate vulnerabilities, handle user input, securely store and transmit data, and understand HTTP and API security. Gain insights for interviews and practice assessments.

tarball.tar.gz

React_Loader

JavaScript is one of the most popular and in-demand programming languages today and its usage shows no signs of slowing down. If you use JavaScript for either the backend or frontend, it is crucial to have a firm understanding of web application security in order to keep our users safe.

In this course, you’ll learn how to mitigate the most common JavaScript vulnerabilities and attacks. For example, you will learn why user-provided input should be treated with caution. Then, you’ll see how to safely store sensitive data on the client and the server, and how to securely transmit it across the internet. Finally, after learning about HTTP and API security, you can take an in-depth assessment to test what you've learned.

Questions about web application security often come up in interviews since knowing security principles is a sign of a mature developer. Should input validation happen on the client or the server? Take this course to find out!

Building Safer JavaScript Applications

Which technique produces an output that is not reversible?

Which technique produces an output that is not reversible?

**(True or False)** Symmetric encryption is always preferred since only one key is used instead of two.

(True or False) Symmetric encryption is always preferred since only one key is used instead of two.

Why should web applications always use HTTPS?

Why should web applications always use HTTPS?

**(True or False)** Cookies should always last a long time because storing the state is convenient for users.

(True or False) Cookies should always last a long time because storing the state is convenient for users.

Which type of attack does the `HttpOnly` cookie attribute help to mitigate?

Which type of attack does the <code>HttpOnly</code> cookie attribute help to mitigate?

What can you set the `SameSite` attribute to in order to help prevent Cross-Site Request Forgery (CSRF)?

What can you set the <code>SameSite</code> attribute to in order to help prevent Cross-Site Request Forgery (CSRF)?

**(True or False)** You don't need to worry about encryption when it comes to cookies because they’re always encrypted when transmitted.

(True or False) You don’t need to worry about encryption when it comes to cookies because they’re always encrypted when transmitted.

**(True or False)** You should always generate hidden source maps for production bundles.

(True or False) You should always generate hidden source maps for production bundles.

**(True or False)** It’s considered good practice to let users see stack traces because it can help them understand what they need to do to fix errors.

(True or False) It’s considered good practice to let users see stack traces because it can help them understand what they need to do to fix errors.

Which process transforms JavaScript into something completely unreadable while still ensuring that it works exactly as before?

Which process transforms JavaScript into something completely unreadable while still ensuring that it works exactly as before?

**(True or False)** JavaScript minification is an effective security measure to prevent others from understanding how your code is written.

(True or False) JavaScript minification is an effective security measure to prevent others from understanding how your code is written.

Properties and methods on the `window` object cannot be easily changed by the user.

**(Select all that apply.)** Which of the following properties and methods on the `window` object can be easily accessed and changed by the user?

(Select all that apply.) Which of the following properties and methods on the <code>window</code> object can be easily accessed and changed by the user?

**(True or False)** Sensitive session information may be stored in a URL as long as HTTPS is used.

(True or False) Sensitive session information may be stored in a URL as long as HTTPS is used.

What is the site for `https://www.quintonlouisaiken.com:3000/bar`?

What is the site for <code>https://www.quintonlouisaiken.com:3000/bar</code>?

**(True or False)** The `frame-ancestors` and `frame-src` Content Security Policy (CSP) directives achieve the same thing.

(True or False) The <code>frame-ancestors</code> and <code>frame-src</code> Content Security Policy (CSP) directives achieve the same thing.

Test yourself about cryptography, cookies, logging, JavaScript privacy, and iframe elements.

Introduction

Common Vulnerabilities, Attacks, and Preventions

Sensitive Data Exposure

HTTP and APIs

JavaScript App Security

Conclusion

Quiz Yourself on Sensitive Data Exposure