Introduction to Web Security
Security concepts, attacks and countermeasures for web applications – independent of the framework, with hands-on exercises.
- 2 Days
- Intermediate
- Remote or in-house
- German & English
Is this training right for your team?
Who it’s for
- Web developers of any framework
- Teams that have to implement security findings from audits
- Tech leads who make security decisions
Afterwards your team can
- Recognize and assess the most common attacks on web applications
- Apply security concepts such as same-origin policy, CORS and CSP correctly
- Check a web application for vulnerabilities themselves
Prerequisites
- Knowledge of HTML, CSS, JavaScript and HTTP
- No prior security knowledge needed
- A laptop with a browser and an editor
A two-day web security workshop, independent of framework and language: from IT security fundamentals and security concepts such as CORS, CSP and OAuth to attacks from the OWASP Top 10 and how to defend against them – with hands-on exercises.
Your team works with Angular and wants the Angular-specific topics right away – Trusted Types, CSP for Angular, tokens in the frontend? Then the Angular Security course is the better fit.
Agenda
The order and the depth of each block are adapted to your team – topics you already master are skipped, your questions get the time instead.
IT security fundamentals
- CIA triad / security principles
- Encryption
- Hashing
- Symmetric / asymmetric encryption
- Authentication & Authorization
Security concepts in web applications
- Same-origin policy / cross-origin resource sharing (CORS)
- Cookie security (cookie attributes such as httpOnly)
- HTTP security
- Using security-relevant HTTP headers correctly
- Content Security Policy (CSP)
- JWT
- OAuth 2 and OpenID Connect
- uvm.
Practical application of the security concepts
- How to ensure data integrity, even when data
- travels over insecure channels
- how to secure the communication channel
- how to protect applications in multiple layers
- how to store passwords securely, and
- What to watch out for when
- Authentication implementation
- using a web framework
- Secure implementation of
- forms and file uploads
- Denial-of-service protection strategies
- Security measures for the frontend and
- secure API development, including REST services
- How to ensure data integrity, even when data
Attacks on web applications
- OWASP Top 10
- Credential attacks
- Cross-site scripting (XSS)
- Cross-site request forgery (CSRF)
- Injection attacks (e.g. SQL)
- DoS
Securing web applications
- Countermeasures for every attack vector covered
Introduction to testing a web application for vulnerabilities
- Manual and automated tools
- Static and dynamic analysis to scan for vulnerabilities
Your trainer
Martina Kraus
Google Developer Expert
Application Security Engineer and Google Developer Expert, speaks about web security at international conferences and co-organizes NG-DE.
Full profile →
Bring this training to your team
For your team only – remote or at your office, on dates that suit you, with examples from your own code base where it helps.
- up to 12 participants (more on request)
- from CHF 2,400 per day for the whole team
- On site: plus travel at cost
- Fixed quote within one business day
- Agenda as PDF – to forward to your manager
Newsletter
Only the latest articles and announcements.
No spam. Promised. By subscribing you agree to our privacy policy.
