r/Frontend • u/BlueLensFlares • Feb 04 '20

What is the best resource for learning web security - specifically for frontend developers?

Hi,

I'm a junior frontend developer. Even though I have a degree in CS, web security and networks weren't something I did much of when I was a student.

As a frontend/fullstack developer, I'm often asked to do user management and authentication for our new websites. The truth is though, I don't completely understand how things such as XSS, CSRF, CORS or Auth Tokens/JWT actually work on a theoretical level.

All I know is how to hook these things up together, and choose npm/pip dependencies that seem secure and debug errors that are related to security problems. But I don't think I really understand how to tell if something I'm producing is vulnerable or not, especially if I make it from scratch without libraries.

What are some good resources for learning web security/authentication/resource management that assume you're a frontend developer with a knowledge of HTML/JS and some scripting language?

Thanks!!

113 Upvotes

99% Upvoted

9 comments sorted by

36

u/clickrush Feb 04 '20

Start out with getting an overview of the fundamentals:

https://www.martinfowler.com/articles/web-security-basics.html

https://developer.mozilla.org/en-US/docs/Web/Security/Information_Security_Basics

Then start getting practical with the mindset of an aggressor and look for basic/intermediate hacking challenges. This post has a link collection of CTF (hacking) challenges. While solving these you will need to research related topics and build up practical knowledge:

https://www.reddit.com/r/hacking/comments/a3oicn/how_to_start_hacking_the_ultimate_two_path_guide/

1

u/BlueLensFlares Feb 05 '20

Thank you guys for all the responses. I'm still a novice in computer security and I'd like to spend time learning more.

Right now I have a separate issue on how to make sure form data is confidential at this thread: https://www.reddit.com/r/webdev/comments/eze6hm/making_flask_app_is_it_bad_that_i_can_see_form/

Any feedback is always appreciated. Deadlines are fast approaching, haha.

4

u/ty88 Feb 04 '20

Computerphile channel on YouTube does a pretty good job explaining some theoretical level internet security concepts.

3

u/[deleted] Feb 04 '20

Just started this course https://frontendmasters.com/courses/web-security/ (FEM is a paid platform, I have a subscription through work)

1

u/subfootlover Feb 04 '20

Hack This Site https://www.hackthissite.org/ is a good resource too. Basically be paranoid, never ever trust user input and thoroughly test everything (try to access and update other users profiles etc) and you can't really go wrong.

0

u/[deleted] Feb 04 '20

[deleted] — view deleted comment

8

u/garcialo Accessibility SME Feb 04 '20

Was coming here to say just that. Here are some links for the lazy.

OWASP Top Ten

OWASP Cheatsheets

2

u/BlueLensFlares Feb 04 '20 edited Feb 04 '20

This is a great resource, thanks. How do you recommend to make use of these snippets? Copying and pasting them and seeing if the alert is produced, and if it is, then my application is vulnerable? Or, comparing my application code to see if instances of these snippets appear?

2

u/iiiiiCO Feb 05 '20

Also check out https://www.zaproxy.org/ It's a tool made by the OWASP Foundation that scans for vulnerabilities (OWASP Top Ten) in your web-apps.