Learn about web application security needed by software engineers every day.

Web App Security

The applications that we create for the web today have to face up to more security risks than ever before. It is extremely important that software developers enforce security best practices, such as how to add protection through HTTP headers, to protect against the myriad vulnerabilities that web applications are subject to. 
In this module, we’ll start by learning how to prevent fraudulent SSL certificates from being served to clients. Then, we’ll move on to learning how to defend against XSS attacks and clickjacking. 
In the latter half of the module, we’ll learn security practices related to HTTP cookies. We’ll also learn some tips related to security tradeoffs that we frequently make in our day-to-day work. Towards the end of the module, we’ll learn how to ward off DDoS attacks, which is crucial when our application scales. 
This module will demystify web security and help us stay on top of important security-related concerns in our web applications.

Web Application Security for the Everyday Software Engineer

## What would *LeBron* do?

It's time to move on from the HTTP protocol and its features. We've been on a long journey, dissecting why cookies were created, how they're structured, and how you can protect them by applying some restrictions on their `Domain`, `Expires`, `Max-Age`, and `Path` attributes, and how other flags such as `Secure`, `HttpOnly`, and `SameSite` are vital in hardening cookies.

Let's move forward and try to understand what we should do, from a security perspective, when we encounter a particular situation. The next chapter will provide advice based on best practices and past experience.

---
Let's take a quiz to test your knowledge of cookies in the next lesson.


# What would *LeBron* do?

It's time to move on from the HTTP protocol and its features. We've been on a long journey, dissecting why cookies were created, how they're structured, and how you can protect them by applying some restrictions on their `Domain`, `Expires`, `Max-Age`, and `Path` attributes, and how other flags such as `Secure`, `HttpOnly`, and `SameSite` are vital in hardening cookies.

Let's move forward and try to understand what we should do, from a security perspective, when we encounter a particular situation. The next chapter will provide advice based on best practices and past experience.

---
Let's take a quiz to test your knowledge of cookies in the next lesson.


Let's end this chapter with a quick conclusion!

Introduction

Understanding The Browser

HTTP

Protection through HTTP Headers

HTTP Cookies

Situationals

DDoS Attacks

Bug Bounty Programs

Conclusion

Conclusion: What Would LeBron Do?

What would LeBron do?