Gain insights into enforcing web app security best practices, such as HTTPS, defending against XSS and clickjacking, managing HTTP cookies, and warding off DDoS attacks.

new.tar.gz

node

cookies

hsts

hsts-https

cookies-https

clickjacking

cors

There are more vulnerabilities than ever when creating applications for the web, so it is extremely important that software developers enforce security best practices such as, how to add protection through HTTP headers.

In this course, you will start off by learning how to prevent fraudulent SSL certificates from being served to clients, before moving on to how to defend against XSS attacks and clickjacking. 

In the latter half of the course, you’ll learn security practices related to HTTP cookies, and tips around security tradeoffs that you’ll make in your day-to-day work. Towards the end, you’ll learn how to ward off DDoS attacks, which is crucial when your application scales.

This course will demystify web security, and help you stay on top of important security-related concerns in your web apps.

Web Application Security for the Everyday Software Engineer

# How BBP platforms work
BBP platforms like HackerOne provide organizations with tools to host an efficient program and offer the kind of network that allows organizations to attract researchers from the get-go.

## Aggregation for researchers and organizations
These platforms are sort of an aggregator of BBP, so the number of researchers browsing the platform and looking for programs is higher than the number of researchers that would bump into your program organically. Researchers know that the platform hosts thousands of programs, so they can easily search through the platform's directory to find new targets. At the same time, organizations tend to join these platforms exactly because of the number of researchers lurking in them, granting broad exposure to their program.

## Monetization model

The way these platforms survive is by charging organizations a fee for joining their service or taking a cut of each bounty awarded through their platform. This makes sure that everyone is a winner: researchers can access thousands of programs, organizations are exposed to thousands of researchers, and the platform monetizes their mutual success by collecting fees in between.

# Example: Starbucks
For a better understanding of how the platform works, we can take a look at the program published by Starbucks. 

## Terms & conditions
It all starts with the program's page, which states terms and conditions at [hackerone.com/starbucks](https://hackerone.com/starbucks).



In this lesson, we'll look at how HackerOne works and see an example of a BBP.

Introduction

Understanding The Browser

HTTP

Protection through HTTP Headers

HTTP Cookies

Situationals

DDoS Attacks

Bug Bounty Programs

Conclusion

HackerOne

How BBP platforms work

Aggregation for researchers and organizations