This book teaches developers how to write secure web applications. Cyberattacks are becoming more commonplace and the Open Web Application Security Project (OWASP), estimates 94% of sites have flaws in their access control alone.  Attacks evolve to work around new defenses, and defenses must evolve to remain effective.  Developers need to understand the fundamentals of attacks and defenses in order to comprehend new techniques as they become available.Topics covered include:A framework for deciding what needs to be protected and how stronglyConfiguring services such as databases and web serversSafe use of HTTP methods such as GET, POST, etc, cookies and use of HTTPSSafe REST APIsServer-side attacks and defenses such as injection and cross-site scriptingClient-side attacks and defenses such as cross-site request forgerySecurity techniques such as CORS, CSPPassword management, authentication and authorization, including OAuth2Best practices for dangerous operations such as password change and resetUse of third-party components and supply chain security (Git, CI/CD etc)The focus is teaching readers how hackers attack applications along with a broad arsenal of defenses.  This enables developers to pick appropriate techniques to close vulnerabilities while still providing their users with their needed functionality.WHAT YOU'LL LEARN:How hackers attack web applicationsAn arsenal of defenses they can use to prevent attacksHow to model their risks so they understand what to defend and howHow to choose appropriate techniques and how to use them together to suit their own situationsHow to implement defenses in Python/Django applicationsWHO IS IT FOR?Developers who already know how to build web applications but need to know more about securityNon-professional software engineers, such as scientists, who must develop web tools and want to make their algorithms available to a wider audience.Engineers and managers who are responsible for their product/company technical security policy weiterlesen