Organize website code to prevent accidentally exposing code or other information that should remain private.
- In the theater, the audience should see … the action on the stage, but not the activity backstage. … You wouldn't want the audience watching … the set changes or wandering through the dressing rooms. … There's a clear division between what gets shown … and what remains hidden. … The same is true for our code. … Websites present visual information to users, … but users should not see the work behind … the scenes that makes it happen. … Controlling output includes controlling visibility. … A behind-the-scenes look at our code … would provide a lot of valuable information for a hacker. … They could see what security defenses … were being used and pinpoint its weakest links. … So we should keep all code private. … The first step you can take to control visibility … is to organize code into two separate directories, … public and private. … You can think of them as on stage and backstage. … The public directory will be accessible by the web server. … It provides a point of entry to our website. …
- Threat models
- Least privilege
- Defense in depth
- Validating and sanitizing input
- Credential attacks
- SQL injection
- Cross-site scripting
Skill Level Beginner
Web Programming Foundationswith Morten Rand-Hendriksen58m 44s Beginner
Web Security: Same-Origin Policieswith Sasha Vodnik1h 54m Advanced
1. Security Overview
2. General Security Principles
3. Filter Input, Control Output
4. The Most Common Attacks
Next steps2m 26s
- Mark as unwatched
- Mark all as unwatched
Are you sure you want to mark all the videos in this course as unwatched?
This will not affect your course history, your reports, or your certificates of completion for this course.Cancel
Take notes with your new membership!
Type in the entry box, then click Enter to save your note.
1:30Press on any video thumbnail to jump immediately to the timecode shown.
Notes are saved with you account but can also be exported as plain text, MS Word, PDF, Google Doc, or Evernote.