Gain insights into enforcing web app security best practices, such as HTTPS, defending against XSS and clickjacking, managing HTTP cookies, and warding off DDoS attacks.

new.tar.gz

node

cookies

hsts

hsts-https

cookies-https

clickjacking

cors

There are more vulnerabilities than ever when creating applications for the web, so it is extremely important that software developers enforce security best practices such as, how to add protection through HTTP headers.

In this course, you will start off by learning how to prevent fraudulent SSL certificates from being served to clients, before moving on to how to defend against XSS attacks and clickjacking. 

In the latter half of the course, you’ll learn security practices related to HTTP cookies, and tips around security tradeoffs that you’ll make in your day-to-day work. Towards the end, you’ll learn how to ward off DDoS attacks, which is crucial when your application scales.

This course will demystify web security, and help you stay on top of important security-related concerns in your web apps.

Web Application Security for the Everyday Software Engineer

I want to open this course with a chapter aimed at understanding what browsers do and a brief explanation on how they work. Since most of your customers will interact with your web application through a browser, it's imperative to understand the basics of these wonderful programs.

The browser is a rendering engine. Its job is to download a web page and render it in a way that's understandable to a human being.

Although this is an oversimplification, it's all we need to know for now: the user enters an address in the browser bar and the browser downloads the "document" at that URL and renders it.

In this lesson, we'll introduce the importance, function, and role of web browsers.

Introduction

Understanding The Browser

HTTP

Protection through HTTP Headers

HTTP Cookies

Situationals

DDoS Attacks

Bug Bounty Programs

Conclusion

Browser Basics