
Explore the attacker mindset and core web security concepts, including same-origin policy, browser risks, and client-server defenses to build secure web applications.
Explore how session hijacking and DNS attacks compromise user identities and web services, then learn defenses against cookies, cross-site scripting, and spoofed DNS queries.
Explore how the web's client-server model operates, detailing HTTP requests and responses, headers, cookies, and common status codes, plus how DNS, caching, and session data shape web security.
Explore how cookies implement sessions, including attributes like expires, path, domain, and same-site, and learn secure practices to prevent cookie theft and cross-site request forgery.
Explore how session hijacking attacks unfold via cookies and session IDs, showing defender strategies like random session IDs and secure, same-site cookies to protect victim accounts.
Explore the same origin policy as the web's security model, how framing and cross-site scripting threaten credentials, and defenses like cookies and same-site origin headers.
Understand the same origin policy and cross-site request forgery, explore how origins govern access, and learn safe cross-origin communication via postMessage and x-frame options.
Explore cross-site scripting and XSS attacks, including reflected and stored types, and learn defenses like input escaping, hex encoding, and template type protections.
Defend against cross-site scripting by applying multiple defenses and escaping user input before rendering. Use content security policy with nonce-based scripting and CSP reporting to protect cookies and data.
Explore phishing and tab-nabbing attacks in client-side security, demonstrate defenses such as rel=no opener and cross-origin opener policy, and preview server-side security in the next part.
This course is a comprehensive overview of web security. The goal is to build an understanding of the most common web attacks and their countermeasures. Given the pervasive insecurity of the modern web landscape, there is a pressing need for programmers and system designers improve their understanding of web security issues.
We'll be covering the fundamentals as well as the state-of-the-art in web security.
Topics include: Principles of web security, attacks and countermeasures, the browser security model, web app vulnerabilities, injection, denial-of-service, TLS attacks, privacy, fingerprinting, same-origin policy, cross site scripting, authentication, JavaScript security, emerging threats, defense-in-depth, and techniques for writing secure code. Course projects include writing security exploits, defending insecure web apps, and implementing emerging web standards.