Gain insights into enforcing web app security best practices, such as HTTPS, defending against XSS and clickjacking, managing HTTP cookies, and warding off DDoS attacks.

new.tar.gz

node

cookies

hsts

hsts-https

cookies-https

clickjacking

cors

There are more vulnerabilities than ever when creating applications for the web, so it is extremely important that software developers enforce security best practices such as, how to add protection through HTTP headers.

In this course, you will start off by learning how to prevent fraudulent SSL certificates from being served to clients, before moving on to how to defend against XSS attacks and clickjacking. 

In the latter half of the course, you’ll learn security practices related to HTTP cookies, and tips around security tradeoffs that you’ll make in your day-to-day work. Towards the end, you’ll learn how to ward off DDoS attacks, which is crucial when your application scales.

This course will demystify web security, and help you stay on top of important security-related concerns in your web apps.

Web Application Security for the Everyday Software Engineer

I wanted to take a moment to mention content I'm planning to integrate into the course, simply to give you an idea of what additional chapters will make it into future updates of this course (at no additional cost):

# Docker security
Containers invaded the world of software applications over the past few years, and understanding how to securely deploy and connect them is a crucial step to keep ourselves up to date in this new way of orchestrating and deploying applications.

# Kubernetes security
Just like Docker, Kubernetes has almost become a de-facto standard, especially for deployments of more complex software architectures. Today, hardening Kubernetes clusters and applications orchestrated within the cluster is an extremely important topic.

# Penetration testing
We've barely scratched the surface of proactively testing our applications through bug bounty programs. Commissioning tests performed by a third party company, such as penetration tests, is an important topic I'd want to touch base on.

# Secret management
On a daily basis, teams need to find a way to secure pieces of information used to run their architecture, from credentials to access S3 buckets to private keys used to encrypt proprietary information. Understanding how to manage secrets effectively is a very important aspect of our job.

# Leveraging other services
We briefly touched on how other services, such as CloudFlare, can help us improve our security in the [DDoS chapter](https://www.educative.io/courses/web-application-security-everyday-software-engineer/introduction-to-ddos).

However, a more in-depth chapter about what services exist to help us improve our security posture is an appropriate topic for this course.

A word of caution, some of these chapters might make it into future updates of this course and some won't. This is a bucket list of content that I genuinely see fit for the course, but there is no timeline on when you should expect this content to land here.

---
We'll conclude this course with a few thank yous to people who helped make it happen!

In this lesson, we'll look at some content that is in the works and will be added to future renditions of this course. 

Introduction

Understanding The Browser

HTTP

Protection through HTTP Headers

HTTP Cookies

Situationals

DDoS Attacks

Bug Bounty Programs

Conclusion

In the Works