Learn about web application security needed by software engineers every day.

Web App Security

The applications that we create for the web today have to face up to more security risks than ever before. It is extremely important that software developers enforce security best practices, such as how to add protection through HTTP headers, to protect against the myriad vulnerabilities that web applications are subject to. 
In this module, we’ll start by learning how to prevent fraudulent SSL certificates from being served to clients. Then, we’ll move on to learning how to defend against XSS attacks and clickjacking. 
In the latter half of the module, we’ll learn security practices related to HTTP cookies. We’ll also learn some tips related to security tradeoffs that we frequently make in our day-to-day work. Towards the end of the module, we’ll learn how to ward off DDoS attacks, which is crucial when our application scales. 
This module will demystify web security and help us stay on top of important security-related concerns in our web applications.

Web Application Security for the Everyday Software Engineer

Only allows connecting to HTTPS websites.

What does the `hsts` header do when turned on?

What does the <code>hsts</code> header do when turned on?

Is <a href="http://educative.io">educative.io</a> HSTS preloaded?

HTTP Public Key Pinning is letting browsers know that your site will only be using (a) certain certificate(s) for a given duration.

HTTP Public Key Protocol is the exchange of public keys between clients and servers after the initial TCP handshake.

HTTP Private Key Protocol is the exchange of public and private keys between clients and servers after the initial HTTP exchange.

It invalidates certificates that were not advertised so if you lose your certificate, or simply make a mistake while testing, your website is gone.

It invalidates IP addresses that were not advertised so if you change your IP or simply make a mistake while testing, your website is gone.

It invalidates certificates that are not registered with a CA so if you change your certificate your website is gone.

How can HPKP lead to websites shutting down?

How can HPKP lead to websites shutting down?

An attacker gets a user to click on a dangerous link by setting its opacity to zero and overlaying it on another (usually very enticing) link.

An attacker gets a user to click on a dangerous link by setting its opacity to one hundred and hiding it behind a harmless looking link.

An attacker gets a user to click on a dangerous link by emailing it or messaging it to them under the guise of an enticing link.

How does a clickjacking attack work?

It stops users from clicking on iframes by increasing their opacity.

How does the `xfo` flag protect us from a clickjacking attack?

How does the <code>xfo</code> flag protect us from a clickjacking attack?

---
On to the next one! Let's learn how HTTP cookies work and how to secure them.


Let's take a quick quiz on protection through HTTP headers.

Introduction

Understanding The Browser

HTTP

Protection through HTTP Headers

HTTP Cookies

Situationals

DDoS Attacks

Bug Bounty Programs

Conclusion

Quiz Yourself on HTTP Headers