    Gain insights into HTTP security headers, learn their risks, explore solutions, and discover how to implement them using Helmet for enhanced web application security.

HSTS_brew_final.tar.gz

Chrome

run_mal

Chrome_hsts

Chrome_hsts-mkcert

debug

Chrome_hsts-mal

Chrome_hsts-inn

This course teaches you hands-on practical use of HTTP security headers as browser security controls to help secure web applications.

For each HTTP security header that can enhance your web application security, you'll learn what is the overall risk of not implementing it, and what does a proposed solution help with. Finally, you'll learn how to implement and configure the security header with Helmet, a popular and well maintained Node.js package on npm.

Web Application Security: Understanding HTTP Security Headers

## Web knowledge prerequisites

You're expected to have basic knowledge of HTTP, including the meaning of HTTP headers, an HTTP request, and response. You'll also need a general knowledge of how the web works with interactions between a web server and a web client (the browser).

It is also expected, but not required, that you have Chrome installed. This course refers to Chrome's DevTools and includes screenshots using the Chrome browser. If you prefer to use another browser and can make the parallels yourself, you should be fine moving forward with the course.

## A JavaScript and Node.js development environment

This course uses the Express web application framework for Node.js to create web applications and set headers using open source modules from the npm ecosystem.

It is expected that you have a working development environment with a supported Node.js version (LTS) along with the `npm` command-line utility.

You'll also need `git` to clone example repositories used along with the exercises if you wish to practice locally.



# Web knowledge prerequisites

You're expected to have basic knowledge of HTTP, including the meaning of HTTP headers, an HTTP request, and response. You'll also need a general knowledge of how the web works with interactions between a web server and a web client (the browser).

It is also expected, but not required, that you have Chrome installed. This course refers to Chrome's DevTools and includes screenshots using the Chrome browser. If you prefer to use another browser and can make the parallels yourself, you should be fine moving forward with the course.

# A JavaScript and Node.js development environment

This course uses the Express web application framework for Node.js to create web applications and set headers using open source modules from the npm ecosystem.

It is expected that you have a working development environment with a supported Node.js version (LTS) along with the `npm` command-line utility.

You'll also need `git` to clone example repositories used along with the exercises if you wish to practice locally.



All you need to get started on this course is a development environment set with "Node.js", "git", "npm", and a working Internet connection!

Some exercises require work with a valid HTTPS-enabled website. For these, we will defer to Heroku as the web hosting platform for its ease of use and ability to support both HTTP and HTTPS web hosting.

Introduction

HTTP Security Headers

Testing for Security Headers

What's Next?

Requirements

Web knowledge prerequisites

A JavaScript and Node.js development environment