Free course

Web Application Security Course

Protect browser-based applications from XSS, injection, CSRF, unsafe uploads, SSRF, broken access control, and insecure deployment.

5 modules · 25 lessons · No signup

Prerequisites: Security Fundamentals, HTML, JavaScript and HTTP

Download this course as PDF or EPUB

Read it offline, on your Kindle, or print it. Join my free newsletter and you get this course plus every other book and course I published.

Download PDFDownload EPUB
~~~

Your progress

of lessons completed.

Course completed.

What you'll learn

Threat-model, harden, test, and operate a small web application across its browser, server, storage, and deployment boundaries.

Course contents

  1. Browser security boundaries

    Reason about origins, cookies, CORS, CSP, storage, and trust between sites.

    1. ✓ Understand the origin boundary
    2. ✓ Protect session cookies
    3. ✓ Configure CORS narrowly
    4. ✓ Add a Content Security Policy
    5. ✓ Check your understanding: browser security boundaries

  2. Injection and output

    Prevent XSS, SQL injection, command injection, and path traversal.

    1. ✓ Prevent cross-site scripting
    2. ✓ Use parameterized database queries
    3. ✓ Avoid command injection
    4. ✓ Keep file paths inside a root
    5. ✓ Check your understanding: injection and output

  3. Requests, files, and servers

    Protect state changes, framing, uploads, and server-side network requests.

    1. ✓ Prevent cross-site request forgery
    2. ✓ Stop clickjacking
    3. ✓ Handle file uploads
    4. ✓ Control server-side requests
    5. ✓ Check your understanding: requests, files, and servers

  4. Access and configuration

    Enforce access control and secure headers, errors, production settings, and admin paths.

    1. ✓ Enforce object authorization
    2. ✓ Set security headers
    3. ✓ Fail without leaking internals
    4. ✓ Protect administrative surfaces
    5. ✓ Check your understanding: access and configuration

  5. Test and operate

    Plan authorized tests, monitor abuse, review releases, and verify fixes.

    1. ✓ Build a security test plan
    2. ✓ Test only with permission
    3. ✓ Monitor web abuse
    4. ✓ Complete a web security review
    5. ✓ Check your understanding: test and operate