Practical Web Security

What you’ll learn

• Think in threat models

  Reason about who your attacker is and what they can reach before writing defences.

• Close the common holes

  Understand and prevent injection, cross-site scripting, and request forgery.

• Get authentication right

  Sessions, password storage, and multi-factor done the way that survives review.

• Harden the deployment

  Headers, transport, secrets, and dependencies — the perimeter around your code.

1. 1Thinking About ThreatsBefore any specific vulnerability: who is attacking, what they want, and what secure defaults look like.23m 35s

   1. Lesson 1.11.1The OWASP Top 10, practicallyFree preview
      14m 58s
   2. Lesson 1.21.2Authentication versus authorization
      3m 41s
   3. Lesson 1.31.3Secure defaults and least privilege
      4m 56s
2. 2Common Web VulnerabilitiesThe three classic classes, how each is exploited, and the defence that genuinely works.32m 43s

   1. Lesson 2.12.1Cross-site scripting (XSS)
      18m 32s
   2. Lesson 2.22.2SQL injection
      4m 14s
   3. Lesson 2.32.3Cross-site request forgery
      9m 57s
3. 3Authentication Done RightIdentity handled properly: session strategy, credential storage, and additional factors.23m

   1. Lesson 3.13.1Sessions versus JWTs
      8m 12s
   2. Lesson 3.23.2Password storage and hashing
      10m 16s
   3. Lesson 3.33.3MFA and delegated authentication
      4m 32s
4. 4Hardening and Supply ChainThe layer around your application: transport, headers, secrets, and the code you did not write.40m 35s

   1. Lesson 4.14.1HTTPS, security headers, and CSP
      8m 6s
   2. Lesson 4.24.2Secrets management
      18m 45s
   3. Lesson 4.34.3Dependency and supply chain risk
      13m 44s