אבטחת ווב
הגנו על המשתמשים שלכם מפני ההתקפות הנפוצות ביותר.
Most attacks on websites are not clever. They abuse the same few mistakes, again and again, with automated tools. This track teaches you to look at your own app the way an attacker does, and then to close each door: SQL injection, cross-site scripting, weak password storage, stolen sessions, cross-site request forgery, leaked secrets, missing HTTPS and broken access control.
Every attack is shown in small, real code in JavaScript, Go, SQL and raw HTTP, next to the fix you can use today.
- שיעורים
- 14
- זמן
- 2 שע׳
- רמה
- מתחילים
השיעורים במסלול הזה זמינים כרגע באנגלית.
- ארד פתוחה
- כסף פתוחה
- זהב נעולה
מוכנים להוכיח?
שלושה מבחנים מחכים: ארד, כסף וזהב.
מה תדעו לעשות
- Treat every input as untrusted and stop SQL injection with parameterized queries
- Prevent cross-site scripting with escaping, safe DOM methods and a Content Security Policy
- Store passwords with Argon2id or bcrypt and slow down password guessing
- Protect sessions with
HttpOnly,SecureandSameSitecookies, and stop CSRF - Keep secrets out of code, and serve every page over HTTPS with security headers
- Check on the server that every user may touch the data they ask for
המסע
1 פרק 1Think like an attacker
Untrusted input, the OWASP Top 10, SQL injection, cross-site scripting and safe password storage.
0 / 52 פרק 2Protect the session
Sessions and cookies, cross-site request forgery, access control, secrets, HTTPS and security headers.
0 / 53 פרק 3Next level
Threat modelling, supply chain security, logging and alerting, and a hands-on security review.
0 / 4