Angular Security Masterclass (with FREE E-Book)
Angular Security Masterclass (with FREE E-Book), available at $84.99, has an average rating of 4.54, with 74 lectures, based on 1354 reviews, and has 13110 subscribers.
You will learn about Code in Github repository with downloadable ZIP files per section Get a solid foundation in Web Security Fundamentals Perform the attacks yourself manually, in order to fully understand them Understand and Defend an Application against common security attacks, such as Dictionary Attacks, Cross-Site Request Forgery, etc. Understand JWT in-depth, including the multiple signature types Design and Implement Application Authentication and Authorization from scratch Know how to add Authentication to an Angular Application using JWTs (and traditional Server Sessions) Know how to add RBAC (Role based Access control) Authorization to an Angular application This course is ideal for individuals who are Angular Developers looking to learn in-depth Web Application Security in the specific context of an Angular Application It is particularly useful for Angular Developers looking to learn in-depth Web Application Security in the specific context of an Angular Application.
Enroll now: Angular Security Masterclass (with FREE E-Book)
Summary
Title: Angular Security Masterclass (with FREE E-Book)
Price: $84.99
Average Rating: 4.54
Number of Lectures: 74
Number of Published Lectures: 74
Number of Curriculum Items: 74
Number of Published Curriculum Objects: 74
Original Price: $74.99
Quality Status: approved
Status: Live
What You Will Learn
- Code in Github repository with downloadable ZIP files per section
- Get a solid foundation in Web Security Fundamentals
- Perform the attacks yourself manually, in order to fully understand them
- Understand and Defend an Application against common security attacks, such as Dictionary Attacks, Cross-Site Request Forgery, etc.
- Understand JWT in-depth, including the multiple signature types
- Design and Implement Application Authentication and Authorization from scratch
- Know how to add Authentication to an Angular Application using JWTs (and traditional Server Sessions)
- Know how to add RBAC (Role based Access control) Authorization to an Angular application
Who Should Attend
- Angular Developers looking to learn in-depth Web Application Security in the specific context of an Angular Application
Target Audiences
- Angular Developers looking to learn in-depth Web Application Security in the specific context of an Angular Application
The course is an Web Application Security Fundamentals Course, where the application will use the Angular/Node stack.
All the server code is in Typescript, but the security concepts explained in it are applicable to other technology stacks.
This course includes an auxiliary Ebook – The Typescript Jumpstart Ebook
We will use several MIT licensed Angular and Node packages from Auth0 (that you could use in your application), and we will also include a demo of how to use Auth0 for doing Application User Management.
Its important to realize that this is NOT an Auth0 specific course. Auth0 will be the source of a couple of open source packages we will use, and will be doing a quick demo of it to show how JWT makes it simple to delegate authentication to a third-party system, which could be developed in-house as well.
Security – A Fundamental Step in a Software Development Career
Security is probably the number one advanced topic that Software Developers are expected to master when going forward in their software development careers.
Security knowledge is hard to come by but its essential for advancing to more senior software development positions, like for example Application Architect or similar.
Learning Web Security Fundamentals, knowing how to design an application for security, and knowing how to recognize and fix security issues is an essential skill for a senior developer.
But the problem is that security knowledge is orthogonal to most other topics and it typically takes years to learn.
The good news is that once you have it, Security knowledge has a much longer shelf live than most software development knowledge in general.
Most of the vulnerabilities and fixes that you will learn in this course were useful 10 years ago, and will (very likely) still be useful 10 years from now – Angular and Node are just an example of one stack, to make the course examples more practical.
Security is seen as something really hard to master – this is actually not the case! Application Security is much more approachable than you might think, depending on how you learn it.
What Is The Best Way To Learn Security in a Fun and Practical Way?
Here is what we will do: we are going to take the skeleton of a running application that has no security yet, and we are going to secure the application step-by-step.
Using a couple of MIT packages from Auth0 (that you would be able to use in any project), we are going to implement the Sign-Up and Loginfunctionality from scratch, and because security cannot be enforced only at the client-side, we will implement both the frontend in Angular and the backend in Node.
As we secure the application, and we are going to periodically attack the application many times during the course, to prove that the vulnerabilities are real!!
By doing so, we will learn along the way the fundamentals of Authentication and Authorization, we will become familiar with common vulnerabilities like Dictionary Attacks, CSRF and others, and we will get familiar with commonly used cryptographic tools like Hashing, Salting, JWT, password storage recommendations and more.
Please don’t be intimidated by these concepts: The focus in this course will not be on the internals of each of the cryptographic tools that we will use, but instead on understanding on a high-level what problems do these tools solve, when to use each and why.
We will also learn how to design our application for security, and we will learn how in many situations application design is ou best defense.
Course Overview
We will start at the beginning: we will see the proper way of doing User Management and Sign Up: we will learn how to store passwords in a database, and we will introduce cryptographic hashes in an approachable way.
Once we have the Sign-Up functionality in place, we will implement Login and understand the need for a temporary identity token. Our first implementation will be stateful login, where the token is kept at the server level.
And at this point we could think we have authentication in place, but we decide to prepare our application for scalability, so we decide to try a JWT (JSON Web Tokens)based approach, because we know that this is what services like Firebase and Auth0 use.
We will use a couple of Auth0 packages to quickly refactor our Login to be JWT based, and learn the advantages of using JWT, and some potential disadvantages as well.
We will then see how its also possible to do Authentication using a third-party JWT-based service like Auth0, effectively removing all authentication logic from both our codebase and our database, and delegating it to a third-party service.
Note that this Auth0-specific part is only a small part of the course, and its main goal is to show how its possible at an enterprise level to delegate authentication to a centralized service, whithout having to introduce direct communication between applications and the centralized authentication service.
This means that if you can’t use Auth0 at your company, you can apply the same design principles and design a JWT-solution that delegates authentication to a centralized server behind the firewall.
We will then cover how to do UI-level role-based functionality in Angular using the Angular Router, and a custom directive for showing or hiding certain parts of the UI depending on the role of the user. We will learn why the Router cannot enforce actual security.
We will also talk about server-side Authorization, and we will implement a commonly needed security-related Admin Level functionality: The Login As User service, that allows an admin to login as any user, to investigate a problem report. We can see why we would need to secure this functionality!
At the end of all these vulnerabilities and security fixes, we will have a well secured application and we will have learned a ton of security-related concepts along the way in a fun and practical way!
What Will you Learn In this Course?
With this course, you will have a rock-solid foundation on Web Application Security Fundamentals, and you will have gained the practical experience of applying those concepts by defending an application from a series of security attacks. You will have done so by actually performing many of the attacks!
You will have learned these concepts in the context of an Angular/Node application, but these concepts are applicable to any other technology stack.
You will learn what built-in mechanisms does Angular provide to defend against security problems, and what vulnerabilities it does NOT defend against and why.
You will be familiar with best practices for password storage, custom authentication service design and implementation, you will know the essentials about cryptographic hashes, be familiar with JWT and several commonly used open source Auth0 packages.
You will be familiar with the following security vulnerabilities: Dictionary attacks, identity token highjacking techniques, the browser same-origin policy, how to combine cookies with JWTs and why, Cross–Site Request Forgery or CSRF, common design vulnerabilities, and more.
You will know common practical solutions for securing both enterprise and public internet applications, such as how to use JWT to delegate authentication to a centralized service, which could be Auth0 or a in-house developed service that follows similar principles.
You will know how to implement UI-level authorization and use client-side constructs like Router guards to implement it and even build your own authorization-related UI directives.
You will also learn about server side authorization, and how to implement a commonly needed backend service that is only accessible to Admins – Login As User.
What Will You Be Able to do at the End Of This Course?
This course could help you take your development career to a more senior level, where the knowledge about web application security is essential and a key differentiating factor.
If you are a private internet business owner or thinking of launching your own platform, this course will contain most of what you need in practice to secure your own online platform in a robust and effective way.
With this course, you will have the knowledge necessary for evaluating many third-party security-related solutions, and you will know where to look for vulnerabilities in your application.
You will be able to understand most application-level vulnerability reports that come out of security audits done by third party companies, and you will be able to understand and fix the most commonly reported problems.
Course Curriculum
Chapter 1: Introduction
Lecture 1: Angular Security Course Helicopter View
Lecture 2: IMPORTANT
Lecture 3: The Typescript Jumpstart Ebook
Lecture 4: Installing Git, Node, NPM and Choosing an IDE
Lecture 5: Installing The Lessons Code – Learn Why Its Essential To Use NPM 5
Lecture 6: How To Run Node In TypeScript With Hot Reloading
Lecture 7: Guided Tour Of The Sample Application
Chapter 2: Sign Up Service – Initial Client and Server-Side Implementation
Lecture 1: Client Side Authentication Service – API Design
Lecture 2: Client Authentication Service – Design and Implementation
Lecture 3: The New Angular HTTP Client – Doing a POST Call To The Server
Lecture 4: User Sign Up Server-Side Implementation in Express
Chapter 3: Password Storage – Hashing and Salting
Lecture 1: Introduction To Cryptographic Hashes – A Running Demo
Lecture 2: Some Interesting Properties Of Hashing Functions – Validating Passwords
Lecture 3: Learn Offline Dictionary Attacks – Why Use Cryptographic Salting?
Lecture 4: Password Key Derivation Functions and The Node Crypto Module
Lecture 5: Using the Argon 2 Hashing Function In Our Sign Up Backend Service
Lecture 6: How To Implement a Password Policy
Lecture 7: Displaying Client-Side Password Validation Errors – What's Next?
Chapter 4: User Session Management
Lecture 1: Switch Branches And User Session Management Section Introduction
Lecture 2: Node Util Promisify – How to Convert Callback Based APIs to Promise-based
Lecture 3: Introduction To Node Async Await – Creating a User Session Id
Lecture 4: Modeling a User Session – Classes Or Interfaces?
Lecture 5: Browser Cookies – How To Use Them For User Session Management
Lecture 6: Attack Scenario – User Identity Theft Attack Using A Third-Party Server
Lecture 7: How To Better Protect The Session Id Using HTTP Only Cookies
Lecture 8: HTTPS Secure Cookies – Running the Angular CLI in HTTPS Mode
Lecture 9: Client-Side User Session Management – Retrieve User Data From Session
Lecture 10: An Ancient Vulnerability – JSON Hijacking, Securing REST Endpoint
Lecture 11: Implementing Logout – Destroying The User Session
Lecture 12: User Login – Step-by-Step Implementation
Lecture 13: Finish Login Functionality and Section Conclusion
Chapter 5: Introduction To JSON Web Tokens
Lecture 1: JSON Web Tokens – Section Introduction
Lecture 2: Creating Your First JWT – What Does It Look Like?
Lecture 3: JSON Web Tokens In a Nutshell
Lecture 4: JSON Web Tokens In Detail – The Header and the Payload
Lecture 5: JWT Signature With HS256 – How Does It Work? Learn What is an HMAC Code
Lecture 6: JWT Signature With RS256 – Learn The Advantages Compared to HS256
Lecture 7: Creating a JWT User Session – Setting Subject and Expiration
Chapter 6: JWT In Practice – Step-by-Step Authentication With JSON Web Tokens
Lecture 1: User Sign Up With JWT – Learn How To Combine Cookies and JWTs
Lecture 2: Server-Side User Identification Via a Custom Express Middleware
Lecture 3: User Retrieval Express Middleware – Error Handling With Async Await
Lecture 4: Finishing The Implementation Of User Identification Middleware
Lecture 5: Backend JWT-based Security Using an Express Middleware
Lecture 6: JWT-based Authentication – Section Conclusion and What's Next
Chapter 7: CSRF – Cross Site Request Forgery
Lecture 1: Understanding CSRF – Step-by-Step Attack Simulation
Lecture 2: CSRF In Detail – Understanding Attack Limitations
Lecture 3: Implementing the CSRF Double Submit Cookie Defense – Server Implementation
Lecture 4: How To Defense Our Application Against CSRF – Client And Server Defenses
Chapter 8: JWT-based Authentication With Auth0
Lecture 1: Auth0 Section Introduction – Using JWTs to Delegate Authentication To 3rd Party
Lecture 2: Integrating a 3rd Party Authentication Provider – Auth0
Lecture 3: Setting Up an Auth0 Externally Hosted Login Page
Lecture 4: How does Auth0 Authentication Work? Logging In a User
Lecture 5: Receiving The Auth0 JWT at Application Startup with parseHash
Lecture 6: Storing the Auth0 JWT In Local Storage
Lecture 7: Adapting the UI To the User Login Status
Lecture 8: Angular HTTP Interceptor – Build an Authentication Interceptor
Lecture 9: JWT Authentication with express-jwt and JSON Web Key Set – Backend Design
Lecture 10: Auth0 JWT-based Authentication – Backend Implementation
Lecture 11: User Sign Up -Requesting Permission to Use Users Email
Lecture 12: User Signup and User Preferences – Frontend Implementation
Lecture 13: User Signup and User Profile – Server-Side Implementation
Lecture 14: Section Summary – The Main Benefit of JWTs
Chapter 9: RBAC Role-Based Authorization
Lecture 1: RBAC Role-Based Authorization – Section Introduction
Lecture 2: Setting Up The RBAC Solution – Adding Roles to our JWT
Lecture 3: Angular RBAC Authorization – Solution Overview
Lecture 4: Backend Express Authorization Route – Design Overview
Lecture 5: Backend Express Authorization Route – Implementation and Demo
Lecture 6: The Admin Login As User Backend Service
Lecture 7: UI RBAC Authorization With The rbacAllow Structural Directive
Lecture 8: The rbacAllow Structural Directive – Final Implementation and Demo
Lecture 9: Authorization Router Guard – Initial Implementation
Lecture 10: Authorization Router Guard Completed – Configuring a Factory Provider
Chapter 10: Conclusion
Lecture 1: Bonus Lecture (Updated August 2024)
Lecture 2: Conclusion and Key Takeaways
Instructors
-
Angular University
Best Selling Angular Courses | 200k+ students | 17 courses
Rating Distribution
- 1 stars: 29 votes
- 2 stars: 29 votes
- 3 stars: 137 votes
- 4 stars: 438 votes
- 5 stars: 722 votes
Frequently Asked Questions
How long do I have access to the course materials?
You can view and review the lecture materials indefinitely, like an on-demand channel.
Can I take my courses with me wherever I go?
Definitely! If you have an internet connection, courses on Udemy are available on any device at any time. If you don’t have an internet connection, some instructors also let their students download course lectures. That’s up to the instructor though, so make sure you get on their good side!
You may also like
- Top 10 Video Editing Courses to Learn in November 2024
- Top 10 Music Production Courses to Learn in November 2024
- Top 10 Animation Courses to Learn in November 2024
- Top 10 Digital Illustration Courses to Learn in November 2024
- Top 10 Renewable Energy Courses to Learn in November 2024
- Top 10 Sustainable Living Courses to Learn in November 2024
- Top 10 Ethical AI Courses to Learn in November 2024
- Top 10 Cybersecurity Fundamentals Courses to Learn in November 2024
- Top 10 Smart Home Technology Courses to Learn in November 2024
- Top 10 Holistic Health Courses to Learn in November 2024
- Top 10 Nutrition And Diet Planning Courses to Learn in November 2024
- Top 10 Yoga Instruction Courses to Learn in November 2024
- Top 10 Stress Management Courses to Learn in November 2024
- Top 10 Mindfulness Meditation Courses to Learn in November 2024
- Top 10 Life Coaching Courses to Learn in November 2024
- Top 10 Career Development Courses to Learn in November 2024
- Top 10 Relationship Building Courses to Learn in November 2024
- Top 10 Parenting Skills Courses to Learn in November 2024
- Top 10 Home Improvement Courses to Learn in November 2024
- Top 10 Gardening Courses to Learn in November 2024