Secure Programming of Web Applications - Developers and TPMs

Name: Secure Programming of Web Applications - Developers and TPMs
Rating: 4.5 (7109 reviews)

Web Application Security for Software Developers and Technical Project Managers

Created byFrank Hissen

Last updated 8/2026

English

ArabicGerman

What you'll learn

Security of Web Applications
Secure Programming Patterns
Security Baselines
Secure Coding

Course content

5 sections • 25 lectures • 1h 51m total length

Introduction and Motivation2:32
Learn how common programming errors create security vulnerabilities and adopt secure programming patterns for web applications, relevant for developers and project managers across internal and public applications.
Well-known Vulnerabilities Overview2:28
Identify well-known web vulnerabilities, including code and sql injection, xss, csrf, file inclusion, directory traversal, clickjacking, session hijacking, and authentication weaknesses, plus third-party libraries and tls concerns.
Causes & Background9:22
Explore the causes and background of web security problems, from the application stack to input validation and output encoding, and understand front end and back end attacks.
Secure Programming in general3:29
Apply general secure programming patterns by linking every session and transaction to authenticated users, validating data ranges and content, and preferring whitelisting over blacklisting.
BankBoard Intro – A vulnerable Java Web Application3:15
Intro to BankBoard, a vulnerable Web forum / board without input filtering and other security measures. Purely for demonstrating purposes. If you are only interested in the factual descriptions, you can skip these lectures!

Code/Command Injection3:08
Explore code and command injection threats and learn secure programming patterns that mitigate risk by avoiding user inputs in commands and using whitelisting.
(No)SQL Code Injection4:25
Explore how SQL and NoSQL code injection occurs when user input is concatenated into queries. Learn to prevent injections using prepared statements and parameterized queries across Java and NoSQL environments.
DEMO: BankBoard SQL Code Injection2:10
(If you are only interested in the factual descriptions, you can skip these DEMO lectures!) Demonstration of a simple SQL code injection exploit using BankBoard as introduced before.
Cross-Site Request Forgery (CSRF)5:20
Explore how CSRF abuses active sessions to trigger state-changing actions like money transfers via HTTP GET, and how tokens in hidden fields are validated on the server side.
DEMO: CSRF2:19
(If you are only interested in the factual descriptions, you can skip these DEMO lectures!) Demonstration of CSRF attack variants using BankBoard as introduced before.
Cross-Site Scripting (XSS)5:24
Learn to prevent cross-site scripting (XSS) by implementing proper output encoding for HTML and JavaScript, addressing persistent, reflected, and DOM-based attacks, and validating input across the application.
DEMO: Simple XSS2:50
(If you are only interested in the factual descriptions, you can skip these DEMO lectures!) Demonstration of some simple XSS attacks in action using BankBoard as introduced before.
Open Redirection4:01
Learn to prevent open redirection by using static redirects or a server-side table mapping IDs to fixed destinations. Apply whitelist filtering for external redirects to ensure only approved destinations.
File Inclusion / Directory Traversal4:59
Explore remote and local file inclusion and directory traversal risks from manipulated paths, and apply whitelisting and canonical path verification with get canonical file to prevent exploits.
Clickjacking4:18
Explore how iframes expose cookies and sessions to clickjacking, and learn defense strategies such as http header frame options and same-origin policy checks to prevent unauthorized embedding.
Session-Hijacking7:20
Learn to prevent session hijacking by managing session IDs and cookies, including temporary vs long sessions, logout, re-authentication for critical actions, and secure HttpOnly cookies with restricted path and domain.
DEMO: XSS with Session-Hijacking2:48
(If you are only interested in the factual descriptions, you can skip these DEMO lectures!) Demonstration of XSS with Session-Hijacking using BankBoard as introduced before.
Information Disclosure3:01
Identify unintentional information disclosure in web applications, from error traces to banner grabbing and usernames and passwords. Learn secure configuration and error handling to protect sensitive data.
Authentication7:23
Explore authentication methods from username-password, certificate-based signing, and token codes to biometrics and multi-factor authentication, and apply secure password practices and anti-brute-force safeguards.
Denial of Service4:32
Protect web applications from denial of service by analyzing resource handling, memory management, and middleware configuration; deploy CAPTCHAs and detection to curb flooding and botnet traffic.
Middleware1:10
Explore how middleware acts as the web application's runtime environment, with examples like Apache with Perl, Tomcat, and SAP; secure configuration, TLS, and patch management are essential.
Third-Party Software1:12
Assess and manage third party software and components, patch vulnerabilities promptly, follow vendor security advisories, and precisely specify and encode input and output formats.
Course Assessment

Java Coding Example (optional) - Secure Password Hashing/PBKDF218:32
In this lecture, we will learn how to code secure password hashing into a Java application. This might be necessary, e.g., in case your application framework does not offer a secure password management function. The used hashing procedure can be changed, the principle remains the same!
Prerequisites are Java, Eclipse (or similar) and the Apache Commons Codec and that you are familiar with encoding schemes like Hex or Base64.
Bonus Lecture - Further Learning Options1:29

Requirements

Web Application Knowledge is a plus
Being a Developer

Description

Understand Application Security: Numerous successful attacks on well-known web applications on a weekly basis should be reason enough to study the background of "Web Application Security" of custom-made or self-developed applications.

Computer systems are ubiquitous and part of our working and private everyday life. For companies it is increasingly complex and difficult to keep up their IT security with the current technical progress. Large enterprises establish security processes which are created according to industry standards (e.g., ISO 27001). These processes are very complex and can only be implemented by teams of security experts. Constant quality assurance, maintenance and adaptation also belong to an IT security process.

It does not matter if a company develops products or runs an online shop, IT security is a characteristic feature. Security incidents, which maybe even reach public uncontrolled, do not only damage the business image but may also lead to legal or financial consequences.

Intro
Typical Vulnerabilities Overview
Cause & Background
Secure Programming in general
Code/Command Injection in general
(No)SQL Code Injection
Cross-Site Request Forgery (CSRF)
Cross-Site Scripting (XSS)
Open Redirection
File Inclusion / Directory Traversal
Clickjacking
Session-Hijacking
Information Disclosure
Attacks on Weaknesses of the Authentication
Denial of Service
Middleware
Third-Party Software
Summary and Conclusion

The principles taught in this course are language and platform independent. However, the course will include examples for Java and PHP.

Instructor Frank Hissen, Computer Scientist and Security Expert, teaches IT security for over 20 years and works for companies of all sizes as IT Security Consultant and Software Engineer.

Who this course is for:

Software Developer
Web Developer

Secure Programming of Web Applications - Developers and TPMs

What you'll learn

Explore related topics

Course content

Intro5 lectures • 21min

Well-known Vulnerabilities and Secure Programming17 lectures • 1hr 6min

Conclusion & Summary1 lecture • 4min

Appendix: Coding Exercises (for developers only)0

Appendix: Further Material2 lectures • 20min

Requirements

Description

Who this course is for: