Gain insights into enforcing web app security best practices, such as HTTPS, defending against XSS and clickjacking, managing HTTP cookies, and warding off DDoS attacks.

new.tar.gz

node

cookies

hsts

hsts-https

cookies-https

clickjacking

cors

There are more vulnerabilities than ever when creating applications for the web, so it is extremely important that software developers enforce security best practices such as, how to add protection through HTTP headers.

In this course, you will start off by learning how to prevent fraudulent SSL certificates from being served to clients, before moving on to how to defend against XSS attacks and clickjacking. 

In the latter half of the course, you’ll learn security practices related to HTTP cookies, and tips around security tradeoffs that you’ll make in your day-to-day work. Towards the end, you’ll learn how to ward off DDoS attacks, which is crucial when your application scales.

This course will demystify web security, and help you stay on top of important security-related concerns in your web apps.

Web Application Security for the Everyday Software Engineer

# Course content
The table of contents for this course appears exhaustive to me, but I know there are quite a few additional chapters that I would have liked to include.

I will try my best to add additional content in future versions of the course, which you will hopefully be able to access as a free update on Educative. 

Containers and [Kubernetes](https://kubernetes.io/) security are chapters I thought of, but I opted to exclude them from this course in order to focus on what I think is most important.

# Runnable code
I would also suggest that you take a look at [github.com/odino/wasec](https://github.com/odino/wasec), a Github repository that includes runnable examples mentioned in this course, mostly written in NodeJS. I tried to keep the examples as zero-config as possible, so most of them require a simple `node index.js`. I have included these runnable examples in this course as well. 

# Feedback

In some cases, there might be incorrect information due to my (mis)interpretation of data, a specification, or other information I obtained while writing this course. Feel free to reach out and let me know what I should fix by using the course feedback form that is part of every lesson.


I can't stress enough the fact that I wrote this course as a software engineer, not as a security researcher. Understand that I've made a living out of writing web apps for various employers from governments to successful startups. I've seen things go south and seen them stay strong. With this course I'm simply trying to share my experience and what I like to keep in mind when trying to secure web applications.

Whether you'd like to suggest the addition of a new chapter, report misinformation, or correct a simple typo, I'd be happy to have a look at your feedback and, hopefully, integrate it into this course, so that other readers can benefit from your contribution.

---
Enough with the formalities. It's now time to see what's cooking! We will start by taking a look at browsers, pieces of software we use on a daily basis that can reserve plenty of surprises for our users. Let's begin in the next chapter!


In this lesson, we'll discuss the course's content, how you can send feedback, and the code mentioned throughout the course.

Introduction

Understanding The Browser

HTTP

Protection through HTTP Headers

HTTP Cookies

Situationals

DDoS Attacks

Bug Bounty Programs

Conclusion

Errata and Additional Content

Course content