Gain insights into enforcing web app security best practices, such as HTTPS, defending against XSS and clickjacking, managing HTTP cookies, and warding off DDoS attacks.

new.tar.gz

node

cookies

hsts

hsts-https

cookies-https

clickjacking

cors

There are more vulnerabilities than ever when creating applications for the web, so it is extremely important that software developers enforce security best practices such as, how to add protection through HTTP headers.

In this course, you will start off by learning how to prevent fraudulent SSL certificates from being served to clients, before moving on to how to defend against XSS attacks and clickjacking. 

In the latter half of the course, you’ll learn security practices related to HTTP cookies, and tips around security tradeoffs that you’ll make in your day-to-day work. Towards the end, you’ll learn how to ward off DDoS attacks, which is crucial when your application scales.

This course will demystify web security, and help you stay on top of important security-related concerns in your web apps.

Web Application Security for the Everyday Software Engineer

## Why encryption?
We're halfway to securing the communication between you and your partner. Now that we've solved authentication (verifying the identity of the caller) we need to make sure we can communicate safely without others eavesdropping in the process. As I mentioned, you're right in the middle of a meeting and need to spell your online banking password. You need to find a way to encrypt your communication so that only you and your partner will be able to understand your conversation.

## Encryption via shared secret

You can do this by establishing a shared secret between the two of you, and encrypt messages through that secret. You could, for example, decide to use a variation of the [Caesar cipher](https://en.wikipedia.org/wiki/Caesar_cipher) based on the date of your wedding.



# Why encryption?
We're halfway to securing the communication between you and your partner. Now that we've solved authentication (verifying the identity of the caller) we need to make sure we can communicate safely without others eavesdropping in the process. As I mentioned, you're right in the middle of a meeting and need to spell your online banking password. You need to find a way to encrypt your communication so that only you and your partner will be able to understand your conversation.

# Encryption via shared secret

You can do this by establishing a shared secret between the two of you, and encrypt messages through that secret. You could, for example, decide to use a variation of the [Caesar cipher](https://en.wikipedia.org/wiki/Caesar_cipher) based on the date of your wedding.



In this lesson, we'll continue our discussion of HTTPS mechanics with how encryption works.

Introduction

Understanding The Browser

HTTP

Protection through HTTP Headers

HTTP Cookies

Situationals

DDoS Attacks

Bug Bounty Programs

Conclusion

Mechanics: Encryption

Why encryption?

Encryption via shared secret