Learn about web application security needed by software engineers every day.

Web App Security

The applications that we create for the web today have to face up to more security risks than ever before. It is extremely important that software developers enforce security best practices, such as how to add protection through HTTP headers, to protect against the myriad vulnerabilities that web applications are subject to. 
In this module, we’ll start by learning how to prevent fraudulent SSL certificates from being served to clients. Then, we’ll move on to learning how to defend against XSS attacks and clickjacking. 
In the latter half of the module, we’ll learn security practices related to HTTP cookies. We’ll also learn some tips related to security tradeoffs that we frequently make in our day-to-day work. Towards the end of the module, we’ll learn how to ward off DDoS attacks, which is crucial when our application scales. 
This module will demystify web security and help us stay on top of important security-related concerns in our web applications.

Web Application Security for the Everyday Software Engineer

By now, we should understand the simple but important concept that browsers are simply HTTP clients built for the average web surfer.


They are more powerful than a platform's bare HTTP client (think of NodeJS's `require('http')`, for example), but at the end of the day, they're just a natural evolution of simpler HTTP clients.

## Introducing `cURL`

As developers, our HTTP client of choice is usually [cURL](http://curl.haxx.se) by Daniel Stenberg. It is one of the most popular software programs web developers use on a daily basis. It allows us to do an HTTP exchange on-the-fly by sending an HTTP request from our command line.



By now, we should understand the simple but important concept that browsers are simply HTTP clients built for the average web surfer.


They are more powerful than a platform's bare HTTP client (think of NodeJS's `require('http')`, for example), but at the end of the day, they're just a natural evolution of simpler HTTP clients.

# Introducing `cURL`

As developers, our HTTP client of choice is usually [cURL](http://curl.haxx.se) by Daniel Stenberg. It is one of the most popular software programs web developers use on a daily basis. It allows us to do an HTTP exchange on-the-fly by sending an HTTP request from our command line.



In this lesson, we'll get an introduction to 'cURL', the browser for developers.

Introduction

Understanding The Browser

HTTP

Protection through HTTP Headers

HTTP Cookies

Situationals

DDoS Attacks

Bug Bounty Programs

Conclusion

A Browser for Developers

Introducing `cURL`