A free, self-paced textbook in 6 chapters. Read a chapter, then drill it with the 162 companion flashcards using spaced repetition.
Web security is the practice of protecting web applications, the users who interact with them, and the data they handle from malicious access, misuse, and disruption. Security fail...
Despite decades of awareness, the same families of flaws keep appearing in web applications. Injection attacks lead the list. SQL injection happens when untrusted input is concaten...
Most web vulnerabilities can be prevented at the point where untrusted data meets code. Input validation is the first line: incoming data should be checked for expected type, forma...
Authentication verifies identity, and session management maintains that authenticated state across subsequent requests, usually by issuing a session ID cookie. The two must not be...
The browser is a willing ally when given the right instructions. Security headers are HTTP response headers that add browser-side protections with little implementation effort. Con...
Several community references anchor day-to-day security work. The OWASP Top 10 is a regularly updated list of the ten most critical web application security risks, published by the...