Sorry, not available in this language yet

English
日本語
简体中文

AI-generated code | Harness the power of AI coding assistants while managing the risks.
API Security Testing | Manage software risks with a holistic API security testing program.
AppSec Program Consolidation | Simplify your application security program.
Application Security Testing | Solutions to address security risks at all stages of the application life cycle.
DevSecOps | Solutions to help shift security left without slowing down your development teams.
Software Supply Chain Security | Solutions to identify and manage software supply chain risks end-to-end.
Manage Enterprise AppSec Risk | Scale your application security program without increasing complexity or adding friction.
Cloud & Container Security | Optimize your applications for secure deployment and operation in the cloud.
Open Source License Compliance | Effective solutions for ensuring open source license compliance.
M&A Due Diligence | Identify software risks that could negatively impact the value of acquired IP.
Quality and Security Standards Compliance | Ensure your software complies with the standards critical to customers and regulators.

Static Analysis (SAST) | Analyzing code for security vulnerabilities without executing it.
Software Composition Analysis (SCA) | Analyzing software components for security and license compliance.
Dynamic Analysis (DAST) | Testing running applications for security vulnerabilities.
Interactive Analysis (IAST) | Real-time security testing during application execution.
Penetration Testing | Simulated cyberattacks to identify vulnerabilities.
Mobile Application Security Testing (MAST) | Ensuring the security of mobile applications.
Application Security Posture Management (ASPM) | Managing and improving application security posture.
Fuzz Testing Solutions | Identifying vulnerabilities by inputting random data to applications.

Automotive | Security solutions for automotive industry applications.
Financial Services | Security solutions tailored for financial services.
IoT & Embedded | Security for Internet of Things and embedded systems.
Medical Devices | Security solutions for medical devices.
Public Sector | Security solutions for government and public sector organizations.

Dev and DevOps Teams | Security tools and practices for development and DevOps teams.
Security Teams | Solutions and support for dedicated security teams.
Legal Teams | Resources and compliance tools for legal teams.

JavaScript Security

Course Description

This course presents an overview of quirks and features that make JavaScript such a flexible, powerful, and popular language. The course does not focus specifically on client-side or server-side JavaScript, but instead gives an overview of security features built into the JavaScript language itself, as well as security features provided by the browsers and utilized by JavaScript web applications.

The main sections of the course offer a deep dive into the most common, most severe, and oldest JavaScript security issue: cross-site scripting (XSS). It examines different JavaScript execution contexts, dataflow concepts for identifying the issues, and protection mechanisms. It also covers the clickjacking vulnerability and mitigation methods. The last lesson focuses on managing dependencies in client-side and server-side applications and tools for identifying vulnerabilities in third-party JavaScript libraries.

Learning Objectives

Navigate JavaScript language specifics, like comparisons and scoping, that may cause security issues
Identify JavaScript execution contexts
Perform manual dataflow analysis with the knowledge of JavaScript sources and sinks
Find common XSS issues in JavaScript code and select the best protection method for each case
Apply several mitigation techniques against the clickjacking vulnerability
Compare different tools for managing third-party dependencies

Details

Delivery Format: eLearning

Duration: 1 1/4 hours

Level: Beginner

Intended Audience

Front-end Developers

Prerequisites

Course Outline

Introduction to JavaScript

What's So Great About JavaScript?
Traditional Browser Security
Same-Origin Policy
Modern-Day JavaScript
Server-Side JavaScript
We Love JavaScript!

Javascript Basics

JavaScript Basics
Strict Mode
Comparing Equality Operators
I'm Watching You
Avoid Global Scope
Separating Scope with ES6 Features
Refrain from Setting document.domain

XSS and Untrusted Data Sources

Introduction to XSS
Dataflow
Untrusted Sources
I'm Loving It... or NOT
“Who Watches the Watchmen?”

JavaScript Execution Contexts

JavaScript Execution Contexts
Inline JavaScript
External JavaScript
Event Handlers
Scalable Vector Graphics
Unique Resource Identifier (URI)
Dynamic Execution: eval
Taking Remote Control of the Demo Gods
Dynamic Execution: Time Functions

XSS Defense Measures

XSS Defenses
Output Encoding
Sanitization
React Strategies
Input Validation
Handling JSON
Headers: X-XSS-Protection Header
Cookies: httpOnly Flag
Load Resources Securely
Resources: Subresource Integrity

Content Security Policy

Content Security Policy
Policies
Hashing and Nonces
CSP Implications
CSP Limitations
Configuring CSP
Improving Your CSP
Writing a Policy for Different Versions of CSP
Extracting Inline JavaScript
You Shall Not Pass!
Final Note: Browser Support

Iframes and Clickjacking

Iframes
Clickjacking
Defense Measure: CSP
Defense Measure: X-Frame-Options
Defense Measure: Frame Busting
Iframe Sandboxing
Iframe Sandboxing Options
Now You See Me

Managing Third-Party Dependencies and Code Analysis

Third-Party Dependencies
Package Managers
Know Your Dependencies
Tools: Third-Party Dependency Audit
Tools: Code Analysis
Manual Review

Training

Developer Security Training

Equip development teams with the skills and education to write secure code and fix issues faster

Learn more about developer security training