Learn about web application security needed by software engineers every day.

Web App Security

The applications that we create for the web today have to face up to more security risks than ever before. It is extremely important that software developers enforce security best practices, such as how to add protection through HTTP headers, to protect against the myriad vulnerabilities that web applications are subject to. 
In this module, we’ll start by learning how to prevent fraudulent SSL certificates from being served to clients. Then, we’ll move on to learning how to defend against XSS attacks and clickjacking. 
In the latter half of the module, we’ll learn security practices related to HTTP cookies. We’ll also learn some tips related to security tradeoffs that we frequently make in our day-to-day work. Towards the end of the module, we’ll learn how to ward off DDoS attacks, which is crucial when our application scales. 
This module will demystify web security and help us stay on top of important security-related concerns in our web applications.

Web Application Security for the Everyday Software Engineer

Most of us prefer to spend our time reviewing interesting repositories on GitHub or skimming through a Google developer advocate's Twitter feed to find cool announcements. Few of us spend time focusing on the boring parts of web development like hardening HTTP cookies with the correct flags.

Truth be told, security is as rewarding as writing code. When it works, you should celebrate your approach and start a round of high-fives with your colleagues.

# Software engineers, students, and non-web software engineers

Besides the everyday software engineer, this course is an interesting read for a few other folks:

* Students or novice programmers. This course will cover technical aspects without digging too deep: we'll talk about HTTPS, but there's no need to deep-dive into how the Diffie-Hellman key exchange algorithm works.
* Non-web software engineers: This course will prove to be an interesting introduction to security on a platform you seldom work with.

This course assumes the average reader has a basic knowledge of web technologies such as browsers, HTML, and JavaScript. You will not need to know the difference between `var` and `let`, but rather how scripts are loaded and executed when a browser renders a web page.

---
In the next lesson, we'll talk about how this course is formatted.


This course is intended for the everyday software engineer that develops web applications.

Who This Course Is For?