Explore JavaScript web application security to mitigate vulnerabilities, handle user input, securely store and transmit data, and understand HTTP and API security. Gain insights for interviews and practice assessments.

tarball.tar.gz

React_Loader

JavaScript is one of the most popular and in-demand programming languages today and its usage shows no signs of slowing down. If you use JavaScript for either the backend or frontend, it is crucial to have a firm understanding of web application security in order to keep our users safe.

In this course, you’ll learn how to mitigate the most common JavaScript vulnerabilities and attacks. For example, you will learn why user-provided input should be treated with caution. Then, you’ll see how to safely store sensitive data on the client and the server, and how to securely transmit it across the internet. Finally, after learning about HTTP and API security, you can take an in-depth assessment to test what you've learned.

Questions about web application security often come up in interviews since knowing security principles is a sign of a mature developer. Should input validation happen on the client or the server? Take this course to find out!

Building Safer JavaScript Applications

A `script` tag with an `src` attribute to make a request for an external JavaScript file.

A string can be passed to `eval` and executed as JavaScript.

An `img` tag with an `onerror` attribute.

**(Select all that apply.)** What are some ways that we can run JavaScript code?

(Select all that apply.) What are some ways that we can run JavaScript code?

Both on the server-side and the client-side.

Where is malicious code injected with XSS stored?

Where is malicious code injected with XSS stored?

**(True or False)** Cookies are always accessible by third-party scripts.

(True or False) Cookies are always accessible by third-party scripts.

**(True or False)** XSS is impossible when using React.

(True or False) XSS is impossible when using React.

What can you use to directly access DOM nodes in React?

What can you use to directly access DOM nodes in React?

**(True or False)** It’s considered good practice to allow users to input what they want. You can always validate the input afterward.

(True or False) It’s considered good practice to allow users to input what they want. You can always validate the input afterward.

**(True or False)** Client-side validation can be done with both JavaScript and HTML.

(True or False) Client-side validation can be done with both JavaScript and HTML.

**(True or False)** Allowlists are much more effective than blocklists since you can be explicit about what should be allowed while blocking everything else.

(True or False) Allowlists are much more effective than blocklists since you can be explicit about what should be allowed while blocking everything else.

Both on the client-side and the server-side

Either on the client-side or the server-side

Where should user input validation occur?

Where should user input validation occur?

**(True or False)** Any and all JavaScript can be encoded so that it looks different, but its original behavior is retained.

(True or False) Any and all JavaScript can be encoded so that it looks different, but its original behavior is retained.

What can you use to prevent `eval` scripts from running on a web page?

What can you use to prevent <code>eval</code> scripts from running on a web page?

**(True or False)** It's safe to use `eval` as long as it’s used on the server.

(True or False) It’s safe to use <code>eval</code> as long as it’s used on the server.

Prepared statements with parameterized queries

What can you use to prevent SQL injection attacks?

What can you use to prevent SQL injection attacks?

**(True or False)** Dynamic queries with string concatenation are fine as long as you ensure that there is no user-provided input.

(True or False) Dynamic queries with string concatenation are fine as long as you ensure that there is no user-provided input.

It omits certain nested dependencies from being included in the dependency tree.

It forces certain nested dependencies to use a specified version.

It’s a way to document which packages have known security vulnerabilities.

It’s a way to mark which packages should be scanned for vulnerabilities in CI.

What does the `resolutions` field do in a `package.json` file?

What does the <code>resolutions</code> field do in a <code>package.json</code> file?

Test yourself about XSS, React escape hatches, input validation, eval, SQL injection, and vulnerable and outdated components.

Introduction

Common Vulnerabilities, Attacks, and Preventions

Sensitive Data Exposure

HTTP and APIs

JavaScript App Security

Conclusion

Quiz Yourself on Common Vulnerabilities, Attacks, and Preventions