Mudule 1:Header Security (DEV522.3, DEV522.6, DEV541.1, DEV544.1)

               X-XSS-Protection

Secure Flag

Http Only Flag

PHP Header

MVC Header

Server Header

X-Content-Type

Mudule 2:Authentication (DEV522.1, DEV541.2, DEV544.2)

Authentication Scenarios

Implementing form authentication

Password Control

CAPTCHA Mechanism

Mitigating brute force attacks

Authentication Protocols (OAuth, OpenId, SAML, FIDO)

Mudule 3:Authorization (DEV522.1, DEV541.3, DEV544.3)

Authorization models

URL authorization

File authorization

Role Based Access Control (RBAC)

Discretionary Access Control (DAC)

Mandatory Access Control (MAC)

Permission Based Access Control

Working with identities

Claim based authorization

Role manager

MVC Authorization

Mudule 4:Session Management (DEV541.2, DEV544.2)

Session management techniques

Session state options in .NET

Avoiding session hijacking

Cookie based session management

Cookie information leakage

Cookie Attribute

Session Expiration

Session management common vulnerabilities

Mudule 5:Input Validation (DEV541.1, DEV544.1)

Data Validation Strategies

Sanitize with Whitelist

Sanitize with Blacklist

Implement Validator

Mudule 6:Output Encoding (DEV541.1, DEV544.1)

Preventing HTML injection

Preventing Cross Site Scripting (XSS)

Mudule 7:Browser Manipulation (DEV541.1, DEV544.1)

Cross Site Request Forgery (CSRF)

Anti CSRF token

CSRF Protection for XHR

Preventing Open Redirection

Preventing ClickJacking

Mudule 8:File Handling

Virtual path mapping

Sanitizing file names

File extension handling

Directory listing

Mudule 9:Cryptography (DEV522.2, DEV541.3, DEV544.3)

Symmetric Encryption

Asymmetric Encryption

Hashing

Mudule 10:AJAX and Web Services Security (DEV522.4)

Web services overview

Security in parsing of XML

XML security

AJAX technologies overview

AJAX attack trends and common attacks

AJAX defense

Mudule 11:Error Handling (DEV541.3, DEV544.3)

Structured exception handling – Try, Catch, Finally

Creating custom error pages

HTTP error codes

Error handling strategies

Mudule 12:Auditing & Logging (DEV541.3, DEV544.3)

Event message structure

Logging best practices