Web Security for Developers

Foundations

• ✓Cryptography basics(1)
• Symmetric encryption(1)
• Asymmetric encryption(2)
• Hashing & signing(2)

Transport & Network

• ✓HTTPS(3)
• ✓HSTS(1)
• CORS(2)
• Content Security Policy(2)
• Security headers(1)
• ✓Clickjacking(1)
• Inspecting certificates(1)

Identity & Authentication

• HTTP authentication(1)
• Password hashing(2)
• Session security(2)
• Cookie security(1)
• Passkeys / WebAuthn / FIDO2(3)
• SSH(2)
• MFA & TOTP(2)
• SAML & identity providers(2)
• LDAP & Active Directory(2)

Authorisation & Tokens

• OAuth 2.0(3)
• OIDC(2)
• JWT(2)

Attacks & Defences

• CSRF(2)
• XSS(2)
• SQL injection(1)
• File upload validation(1)
• Timing attacks(1)

Cryptography

• ✓HMAC & webhook signing(1)
• GPG(1)

Infrastructure

• mTLS(1)
• Secrets management(1)
• Hardware security modules(1)
• Rate limiting & throttling(1)
• Zero trust(2)

Compliance & Governance

• GDPR(2)

The bigger picture

• Also think about(1)