Gain insights into enforcing web app security best practices, such as HTTPS, defending against XSS and clickjacking, managing HTTP cookies, and warding off DDoS attacks.

new.tar.gz

node

cookies

hsts

hsts-https

cookies-https

clickjacking

cors

There are more vulnerabilities than ever when creating applications for the web, so it is extremely important that software developers enforce security best practices such as, how to add protection through HTTP headers.

In this course, you will start off by learning how to prevent fraudulent SSL certificates from being served to clients, before moving on to how to defend against XSS attacks and clickjacking. 

In the latter half of the course, you’ll learn security practices related to HTTP cookies, and tips around security tradeoffs that you’ll make in your day-to-day work. Towards the end, you’ll learn how to ward off DDoS attacks, which is crucial when your application scales.

This course will demystify web security, and help you stay on top of important security-related concerns in your web apps.

Web Application Security for the Everyday Software Engineer

## Discontinued acceptance of HTTP 

Still debating whether you should support HTTPS on your website? I don't have good news for you; browsers have started to push users away from websites that don't support HTTPS in order to force web developers towards providing a fully encrypted browsing experience.

Behind the motto "*[HTTPS everywhere](https://www.eff.org/https-everywhere)*", browsers started to take a stand against unencrypted connections. Google was the first browser vendor who gave web developers a deadline, announcing that starting with Chrome 68 (July 2018) it would mark HTTP websites as "not secure".



Even more worrying for websites not taking advantage of HTTPS is the fact that, as soon as the user inputs anything on the webpage, the "Not secure" label turns red, a move that should encourage users to think twice before exchanging data with websites that don't support HTTPS.



# Discontinued acceptance of HTTP 

Still debating whether you should support HTTPS on your website? I don't have good news for you; browsers have started to push users away from websites that don't support HTTPS in order to force web developers towards providing a fully encrypted browsing experience.

Behind the motto "*[HTTPS everywhere](https://www.eff.org/https-everywhere)*", browsers started to take a stand against unencrypted connections. Google was the first browser vendor who gave web developers a deadline, announcing that starting with Chrome 68 (July 2018) it would mark HTTP websites as "not secure".



In this lesson, we'll look at the importance of HTTPS more closely.

Introduction

Understanding The Browser

HTTP

Protection through HTTP Headers

HTTP Cookies

Situationals

DDoS Attacks

Bug Bounty Programs

Conclusion

Deploy an API to Production Using Nginx

HTTPS Everywhere

Discontinued acceptance of HTTP