Web Security Fundamentals – sessions 3

Session 3
This session explores advanced browser-side protections using Content Security Policy. You will learn how to design, implement, and deploy CSP to reduce the impact of client-side attacks. The session then covers Cross Site Request Forgery, explaining how attackers exploit user sessions and trusted browsers. Participants will understand how cookies play a central role in CSRF attacks. Practical mitigation strategies such as anti-CSRF tokens and secure cookie handling are demonstrated.

Session #3
7 - CSP-Part 1
8 - CSP-Part 2
9 - CSRF

Briefly about the teaching: Today’s internet is a very rough place, with robots, spies, states, hackers, and other evil entities constantly roaming around the web looking for vulnerable web applications to attack. Because of this, it is very important that every developer has the necessary skills to protect their applications. In this hands-on course, you will learn the fundamentals of how the web works, how to protect your applications, and how attacks are performed. It goes beyond the OWASP TOP-10 and gives you many concrete examples of how to fail and how to protect your applications.

This course is constantly improved as new security vulnerabilities, and best practices emerge.

Audience:
This course targets developers on all platforms, including .NET, Java, and PHP.

Prerequisites
You should have basic web development experience, including HTML, CSS and JavaScript. After the course, the participant can: After the course, the participant will have a thorough understanding of web security, capable of identifying and defending against common security threats such as XSS, CSRF, ensuring robust protection for web applications

Instructor Tore Nestenius is an independent software consultant and trainer based in Helsingborg, Sweden. For the last 10 years, he has been training developers all around the world in software architecture, web security, OpenID-connect, C#/.NET and domain-driven design. When he is not teaching, he is mentoring and coaching developer teams all around Europe.

• You must register for each session separately.
• The webinar will not be recorded and shared.
• Link will be sent the day before the course.