A free, self-paced textbook in 6 chapters. Read a chapter, then drill it with the 50 companion flashcards using spaced repetition.
The Open Worldwide Application Security Project (OWASP) publishes a regularly updated list of the ten most critical web application security risks, and the 2021 edition includes br...
Secure communication over the web depends on Transport Layer Security (TLS), the protocol underlying HTTPS. During the TLS handshake, the client proposes supported cipher suites, t...
Authentication and authorization are often conflated, but they answer fundamentally different questions. Authentication verifies who you are, typically through something you know (...
Browsers enforce a powerful default protection called the Same-Origin Policy, which prevents scripts loaded from one origin from reading resources served by a different origin. Two...
Sessions, secrets, and rate limits form the operational backbone of a secure application. Secure session management begins with generating session identifiers using a cryptographic...
Beyond any single technology, robust software security rests on a small number of enduring design principles. The principle of least privilege holds that every user, program, and p...