Gain insights into enforcing web app security best practices, such as HTTPS, defending against XSS and clickjacking, managing HTTP cookies, and warding off DDoS attacks.

new.tar.gz

node

cookies

hsts

hsts-https

cookies-https

clickjacking

cors

There are more vulnerabilities than ever when creating applications for the web, so it is extremely important that software developers enforce security best practices such as, how to add protection through HTTP headers.

In this course, you will start off by learning how to prevent fraudulent SSL certificates from being served to clients, before moving on to how to defend against XSS attacks and clickjacking. 

In the latter half of the course, you’ll learn security practices related to HTTP cookies, and tips around security tradeoffs that you’ll make in your day-to-day work. Towards the end, you’ll learn how to ward off DDoS attacks, which is crucial when your application scales.

This course will demystify web security, and help you stay on top of important security-related concerns in your web apps.

Web Application Security for the Everyday Software Engineer

A token used to identify clients and their sessions.

A token used to identify servers and their sessions.

A token that must contain sensitive information.

Session cookies stay on the client's machine forever whereas persistent cookies get deleted.

Persistent cookies stay on the client's machine forever whereas session cookies get deleted.

Persistent cookies stay on the client's machine for as long as its `max-age` or `Expires` directives say, whereas session cookies get deleted at the end of the session.

What is the difference between session and persistent cookies?

What is the difference between session and persistent cookies?

ALWAYS use session cookies over persistent cookies!

ALWAYS use session cookies over persistent cookies!

`Domain` restricts the cookie to a certain domain whereas `path` restricts the cookie to a certain path on the domain. 

`Path` restricts the cookie to a certain domain whereas `domain` restricts the cookie to a certain path on the domain. 

What is the difference between the `Domain` directive and the `path` directive?

What is the difference between the <code>Domain</code> directive and the <code>path</code> directive?

Clients self-generate their cookies and send them to servers with the header `Cookie`.

Servers send them with an HTTP header `Set-Cookie`.

Servers send them as part of the initial TCP handshake.

How do servers set cookies on to clients?

How do servers set cookies on to clients?

What cookie directive would the following value be set for?

```
Date: Fri, 24 Aug 2018 04:33:00 GMT
```

What cookie directive would the following value be set for?
<pre><code>Date: Fri, 24 Aug 2018 04:33:00 GMT
</code></pre>

If a host-only cookie is set on `educative.io`, it will be visible on `blog.educative.io`

If a host-only cookie is set on <code>educative.io</code>, it will be visible on <code>blog.educative.io</code>

They would take up too much space and crash the TLD servers.

Cookies should never be encrypted. They will be rendered useless if so.

That would prevent a man in the middle from stealing cookies and impersonating users.

That would prevent a cookie from being sent to a different domain.

Why is it important to encrypt cookies?

What flag can be used to prevent JavaScript from accessing cookies?

What flag can be used to prevent JavaScript from accessing cookies?

---
It's time to introduce *situationals*. Let's study them in the next chapter.

Introduction

Understanding The Browser

HTTP

Protection through HTTP Headers

HTTP Cookies

Situationals

DDoS Attacks

Bug Bounty Programs

Conclusion

Quiz Yourself on HTTP Cookies