Security basics
Understand HTTPS, CORS, cookies, SSRF and the headers that reduce risk.
What you will be able to do
- Use HTTPS everywhere.
- Set Secure, HttpOnly and SameSite on cookies.
- Allow only the origins you need in CORS.
- Validate every redirect and outbound URL.
In plain English
Most web security is about boundaries: origin, authentication and input. Use HTTPS, set cookies with Secure and HttpOnly, restrict CORS, validate redirects and never fetch arbitrary user-supplied URLs from the server.
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: default-src 'self'; frame-ancestors 'none'
X-Content-Type-Options: nosniff
Referrer-Policy: no-referrerYour turn
MediumSet a secure cookie
Write an HTTP header that sets a session cookie with Secure, HttpOnly and SameSite=Lax.
HTTP · starter
Set-Cookie:Check your understanding before moving on.
Knowledge checkQuestion 1
Which cookie flag prevents JavaScript from reading the cookie?
Select an answer to continue
Study tools
Make it yours.
Keep a private note for this lesson, then turn the key ideas into flashcards you can revisit.
Sign in to save notes and flashcards.Both are private to your account and stay with your progress.
Sign inFinished reading?
Lock in what you just learned.
0%
Mark this lesson complete to save your place and move one step closer to the certificate.