https://github.com/lirantal/learning-http-security-headers-book
Hands-on practical use of HTTP security headers as browser security controls to help secure web applications
https://github.com/lirantal/learning-http-security-headers-book
Last synced: 3 months ago
JSON representation
Hands-on practical use of HTTP security headers as browser security controls to help secure web applications
- Host: GitHub
- URL: https://github.com/lirantal/learning-http-security-headers-book
- Owner: lirantal
- Created: 2021-08-07T06:39:33.000Z (about 4 years ago)
- Default Branch: main
- Last Pushed: 2023-01-14T14:06:07.000Z (over 2 years ago)
- Last Synced: 2025-04-23T21:43:53.410Z (6 months ago)
- Size: 6.78 MB
- Stars: 18
- Watchers: 8
- Forks: 3
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
Awesome Lists containing this project
README
# Web Security: Learning HTTP Security Headers
Authored by Liran Tal
[](https://leanpub.com/web-security-learning-http-security-headers)
---
This book is a follow-up on Liran Tal's [Essential Node.js Security for Express web applications](https://leanpub.com/essential-nodejs-security) and teaches you hands-on practical use of HTTP security headers as browser security controls to help secure web applications.
For each HTTP security header that can enhance your web application security, you'll learn what is the overall risk of not implementing it, and what does a proposed solution help with. Finally, you'll learn how to implement and configure the security header with Helmet, a popular and well-maintained Node.js package on npm.
I made this book available and open source on GitHub to spread the knowledge, but you may also get a PDF formatted copy of it via Leanpub here: [Web Security: Learning HTTP Security Headers](https://leanpub.com/web-security-learning-http-security-headers)
## In the book
18 Lessons, 8 Quizzes, 30 Code Snippets, and 19 Illustrations to help you learn.
Takeaway Skills:
* Secure web applications using HTTP security headers
* Understand Content Security Policy
* Setup Node.js web applications securely
* Learn how to test and monitor for security headers and vulnerable JavaScript libraries
* Roadmap for future web controls
## Table of Contents
- [Frontmatter](./manuscript/frontmatter.md)
- [About the author](./manuscript/about-the-author.md)
- [About the book](./manuscript/about-the-book.md)
- [Chapter 1: Introduction](./manuscript/Chapter-01-Introduction.md)
- [Chapter 2: HTTP Security Headers](./manuscript/Chapter-02-HTTP%20Security%20Headers.md)
- [Chapter 3: Testing for Security Headers](./manuscript/Chapter-03-Testing%20for%20Security%20Headers.md)
- [Chapter 4: What's next](./manuscript/Chapter-04-Whats%20next.md)
## Testimonials
Michael Azimov
SOFTWARE DEVELOPER FUNDBOX
> I started reading the book few days ago and I am half way in it, and I must say that although I kinda knew that I should use all these HTTP headers, your book really made me understand why I should use them and what could happen if I dont, and most importantly- if the browsers yells at you, dont just give up and remove the headers 😆
Luke Rasmus
PROGRAMMER/ANALYST
> Absolutely awesome - really. This was targeted at a perfect level for me, as someone who had exposure to these topics, had done some fiddling with helmet previously in node, but this was a great succinct guide to quickly and effectively teach "what" and "why".
Sumit Kumar
FRONT END ENGINEER AND DESIGNER
> To the point content. Short book - this one is just for me as I like books that are short. I like the interesting facts about technology terms mid-sections. The code examples are good. I like the educational approach of Risk→Solution→Implementation. I like the use of GitHub to serve the example source code. Some topics I found to be complicated, like HTTP Strict Transport Security.
## Code Samples
TBD
# Author
> Liran Tal is a software developer, and a GitHub Star, world-recognized for his activism in open source communities and advancing web and Node.js security. He engages in security research through his work in the OpenJS Foundation and the Node.js ecosystem security working group, and further promotes open source supply chain security as an OWASP project lead. Liran is also a published author of Essential Node.js Security and O'Reilly's Serverless Security. At Snyk, he is leading the developer advocacy team and on a mission to empower developers with better dev-first security.
Liran Tal
# Contributing
Corrections and improvements are welcome.
Please fork the repository and submit a merge request.
When you make a pull request, make sure to add your name to the list of contributors in [CONTRIBUTORS.md](CONTRIBUTORS.md).
# License
The book is licensed under CC's BY-NC-ND version 4.
