Security headers and TLS for web apps
You write the headers that tell the browser its security rules, set up TLS versions, cipher suites and the certificate chain correctly, then measure the result with tools and keep watching it.
Level 201 · 15 lessons · 13 practice labs
Lessons
Security headers
- Security headers overview: what each one protects
- HSTS: locking the browser to HTTPS and the preload list
- Writing a CSP header: default sources and report-only mode
- X-Content-Type-Options, Referrer-Policy and Permissions-Policy
- Cross-origin isolation headers: COOP, COEP and CORP
- Short task: measure the lab app’s headers and add what is missing
TLS configuration
- The TLS handshake: what the server offers and the browser picks
- Certificates and chains: the missing intermediate
- Protocol versions and cipher suites: what to switch off
- Automatic certificate renewal with ACME
- Auditing TLS with testssl.sh and sslyze
- Short task: find and fix weak TLS settings, then rescan
Keeping it right
- Cookie security review: flags, scope and prefixes
- Monitoring header and certificate changes
- Capstone: bring a site to a top-grade header and TLS configuration and prove it
Practice labs
- Fill in the missing security headers: Measure the lab site's responses with curl, add the missing X-Content-Type-Options and Referrer-Policy headers and measure again.
- HSTS, but subdomains left out: Show the HSTS header does not cover subdomains and fix it with includeSubDomains and a suitable max-age.
- Camera and location with Permissions-Policy: Write a policy that turns off camera and location on pages that do not need them and show an embedded frame can no longer use them.
- Headers returned only on some paths: Find security headers missing on error pages and static files and fix them to apply to every response.
- Cross-origin isolation with COOP and COEP: Isolate a page with COOP and COEP, fix the broken third-party resources with CORP and prove isolation is active.
- A missing intermediate certificate: Find the missing intermediate certificate in the lab server's chain, fix the chain and show verification succeeds.
- Turn off old protocol versions: Find old TLS versions and weak cipher suites left on with testssl.sh, fix the configuration and scan again.
- About to expire: automatic renewal: Set up automatic ACME renewal against the lab CA for a certificate close to expiry and show the renewal works.
- Prioritise the sslyze findings: Rank the findings in the sslyze output by impact, fix the critical ones and write a justified acceptance note for the rest.
- TLS at the reverse proxy and the back-end link: Show TLS ends at the proxy and travels to the back end in plain text, then encrypt the inner link with the lab CA and verify it.
- Cookie review: flags and prefixes: List all cookies on the lab site, fix those with missing flags or scope and apply the __Host- prefix.
- A check that catches header regressions: Write a script that checks security headers and certificate expiry daily and show it catches a deliberate regression.
- Move to a top-grade configuration: Bring the fictional Halcyra Hotels site to the top grade for headers and TLS and prove it with before-and-after scan output.
About this course
You write the headers that tell the browser its security rules, set up TLS versions, cipher suites and the certificate chain correctly, then measure the result with tools and keep watching it.
What you will learn
- Security headers
- TLS configuration
- Keeping it right
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.