Learn about web application security needed by software engineers every day.

Web App Security

The applications that we create for the web today have to face up to more security risks than ever before. It is extremely important that software developers enforce security best practices, such as how to add protection through HTTP headers, to protect against the myriad vulnerabilities that web applications are subject to. 
In this module, we’ll start by learning how to prevent fraudulent SSL certificates from being served to clients. Then, we’ll move on to learning how to defend against XSS attacks and clickjacking. 
In the latter half of the module, we’ll learn security practices related to HTTP cookies. We’ll also learn some tips related to security tradeoffs that we frequently make in our day-to-day work. Towards the end of the module, we’ll learn how to ward off DDoS attacks, which is crucial when our application scales. 
This module will demystify web security and help us stay on top of important security-related concerns in our web applications.

Web Application Security for the Everyday Software Engineer

HTTP has changed significantly over the past 20 years.

HTTP has not changed significantly over the past 20 years.

The technical implementation of how clients and servers talk to each other has not changed much.

Which of the following is correct?

The following is an HTTP ______.
```http
GET /players/shahid-afridi HTTP/1.1
Host: cricket.pk
Accept: */*
```

The following is an HTTP ______.
<pre><code class="language-http">GET /players/shahid-afridi HTTP/1.1
Host: cricket.pk
Accept: */*
</code></pre>

No, because the headers 'Coolness' and 'request-strike-rate' are invalid.

Is the following a valid HTTP request?

```http
GET /players/shahid-afridi HTTP/1.1
Host: cricket.pk
Accept: */*
Coolness: 9000
request-strike-rate: yes
```

Is the following a valid HTTP request?
<pre><code class="language-http">GET /players/shahid-afridi HTTP/1.1
Host: cricket.pk
Accept: */*
Coolness: 9000
request-strike-rate: yes
</code></pre>

H2 was a more secure version of HTTP/1.1.

H2 was a more secure version of HTTP/1.1.

HTTPS is a way to secure HTTP/1.1.

making sure your communication cannot be read by a third party

making sure your communication cannot be understood by a third party

making sure the party you are talking to is the one you meant to talk to

Authentication in the world of security is ___.

Authentication in the world of security is ___.

Encryption in the world of security is ____.

Encryption in the world of security is ____.

To authenticate a particular server by issuing a certificate with its own digital signature.

To speed up communication between two parties.

To provide servers with unsigned certificates

POST should be used over GET to send sensitive data to the server.

POST should be used over GET to send sensitive data to the server.

Introduction

Understanding The Browser

HTTP

Protection through HTTP Headers

HTTP Cookies

Situationals

DDoS Attacks

Bug Bounty Programs

Conclusion

Quiz Yourself on HTTP