Explore JavaScript web application security to mitigate vulnerabilities, handle user input, securely store and transmit data, and understand HTTP and API security. Gain insights for interviews and practice assessments.

tarball.tar.gz

React_Loader

JavaScript is one of the most popular and in-demand programming languages today and its usage shows no signs of slowing down. If you use JavaScript for either the backend or frontend, it is crucial to have a firm understanding of web application security in order to keep our users safe.

In this course, you’ll learn how to mitigate the most common JavaScript vulnerabilities and attacks. For example, you will learn why user-provided input should be treated with caution. Then, you’ll see how to safely store sensitive data on the client and the server, and how to securely transmit it across the internet. Finally, after learning about HTTP and API security, you can take an in-depth assessment to test what you've learned.

Questions about web application security often come up in interviews since knowing security principles is a sign of a mature developer. Should input validation happen on the client or the server? Take this course to find out!

Building Safer JavaScript Applications

**(True or False)** Authorization (AuthZ) verifies the identity of a user or service.

(True or False) Authorization (AuthZ) verifies the identity of a user or service.

It uses base64 strings that are easily decoded.

It doesn’t support server-side sessions.

Why is the basic authentication scheme built into HTTP outdated, and why should it only be used with HTTPS?

Why is the basic authentication scheme built into HTTP outdated, and why should it only be used with HTTPS?

Providing full-blown, secure authentication and authorization.

Simple third-party services in which the API consumers are other web application developers.

**(True or False)** User state is stored in a server-side database or distributed cache for both session-based and token-based authentication.

(True or False) User state is stored in a server-side database or distributed cache for both session-based and token-based authentication.

Which HTTP security header restricts the inline script tags that can be executed on a web page?

Which HTTP security header restricts the inline script tags that can be executed on a web page?

Which HTTP security header prevents browsers from loading documents using HTTP and enforces HTTPS instead?

Which HTTP security header prevents browsers from loading documents using HTTP and enforces HTTPS instead?

**(True or False)** All Cross-Origin Resource Sharing (CORS) requests first send a preflight request.

(True or False) All Cross-Origin Resource Sharing (CORS) requests first send a preflight request.

**(True or False)** By default, a Cross-Origin Resource Sharing (CORS) request is made without credentials.

(True or False) By default, a Cross-Origin Resource Sharing (CORS) request is made without credentials.

Which of the following is not an effective Cross-Site Request Forgery (CSRF) prevention technique?

Which of the following is not an effective Cross-Site Request Forgery (CSRF) prevention technique?

Which of the following is not a helpful Cross-Site Request Forgery (CSRF) prevention technique?

Which of the following is not a helpful Cross-Site Request Forgery (CSRF) prevention technique?

**(True or False)** Using CSRF tokens is an effective way to prevent Cross-Site Request Forgery (CSRF) attacks.

(True or False) Using CSRF tokens is an effective way to prevent Cross-Site Request Forgery (CSRF) attacks.

**(True or False)** Cross-Origin Resource Sharing (CORS) is not necessary when using Subresource Integrity (SRI).

(True or False) Cross-Origin Resource Sharing (CORS) is not necessary when using Subresource Integrity (SRI).

**(True or False)** Content Security Policy (CSP)is not necessary when using Subresource Integrity (SRI).

(True or False) Content Security Policy (CSP)is not necessary when using Subresource Integrity (SRI).

Test yourself about API security topics including authentication, authorization, headers, CORS, CSRF, and SRI.

Introduction

Common Vulnerabilities, Attacks, and Preventions

Sensitive Data Exposure

HTTP and APIs

JavaScript App Security

Conclusion

Quiz Yourself on HTTP and APIs