Course description

React applications disrupt the traditional web security landscape, and finding reliable security advice is hard. Most React security content is superficial and ignores challenges real-world applications face. This course will help you to truly understand attacks and defenses in a React world.

With a mix of lectures, demos, quizzes, and cheat sheets, participants discover best practices for building secure React applications. We explore what security measures React provides out-of-the-box, along with common mistakes that circumvent these protections. Using concrete examples, we build up a set of best practices to address the security shortcomings of React. Additionally, we discuss how to use modern browser features, such as Content Security Policy and Trusted Types, to apply a defense-in-depth strategy to your React applications. Finally, we investigate how to apply the covered security guidelines in server-side rendering scenarios.

This course offers a deep understanding of vulnerabilities and defenses in modern React applications. At the end of this course, you walk away with practical and immediately applicable security advice to improve the security of your React applications.



This course is fully recorded and all recordings are available on the course platform.

Course contents

The outline below shows you which topics are covered in this course.


Introduction

  • The security model of web applications


XSS in React applications

  • The security model of web applications
  • The cause and effect of cross-site scripting (XSS) vulnerabilities
  • The limitations in the way React handles XSS
  • Secure coding guidelines to avoid XSS in React
  • Advanced XSS attack vectors in React


Content Security Policy

  • The purpose of Content Security Policy (CSP)
  • Configuring a modern CSP policy to combat XSS
  • Actionable deployment guidelines that address challenges with CSP and React
  • Guidelines on using CSP as a defense-in-depth defense


Trusted Types

  • The cutting-edge Trusted Types security feature
  • How Trusted Types addresses common XSS vulnerabilities
  • Deploying Trusted Types in React applications


Securing Server-Side Rendering

  • The security challenges of server-side rendering (SSR)
  • Avoiding XSS in SSR React
  • The limitations of defense-in-depth mechanisms with SSR


Conclusion

  • Wrapping up

Course pricing

  • Cutting-edge React security
     

    Subscribe to this course, which gives you access to the recordings, slides, quizzes, and code examples.

    $ 359

    Sign up for this course

  • React security + API security
     

    Save 20% by getting the course bundle, giving you access to this course and the API Security best practices course.

    $ 659

    Save 20% with the bundle

  • React security + API security
    with private consulting

    Get the course bundle, plus 2 hours of private consulting with Philippe, scheduled at your convenience.

    $ 1459

    Get the full package

Why should you follow this course?

This course is 100% relevant for anyone involved with building React applications. Concretely, you should follow this course if ...


... you want to turn your knowledge level of React Security all the way up to 11.

... you want to learn code hygiene techniques that allow you to apply React secure coding guidelines at scale.

... you are looking for actionable advice that addresses the intricacies of using complex technologies, such as Content Security Policy or Trusted Types, in React applications.

... other security courses failed to meet your expected level of profoundness. This course will help you understand why security issues exist and how defenses work so that you can apply them in any scenario.

What content is included in this course?

This course offers practical and immediately applicable security advice to React developers. Concretely, this course gives you access to:


  • Full-length recordings of the live teaching sessions, including lectures and demos

  • High-quality PDF materials of the lectures

  • Code examples used during the demos

  • Complimentary access to the remastered recordings, as soon as they are available 

Your instructor

Dr. Philippe De Ryck

Hi, I'm Philippe, your instructor for this course. I provide professionals like you with the high-quality security knowledge they need to perform at their best.

My PhD in web security has not only given me an exceptionally strong security background, it has also taught me how to methodically explain complex security concepts. This course rigorously translates that knowledge into security best practices for modern applications.

If you want to get an idea of what I have to offer, I recommend checking out my security articles or any of my recorded conference talks.

Finally, these testimonials from previous training participants should tell you everything you need to know.

We hired Phillipe De Ryck for a training on API Security. His mix of content and quizzes kept people well engaged. He was very clearly knowledgeable and patient as he took the time to be sure everyone’s questions were fully answered. Phillipe will definitely be at the top of our short list of people we want to bring back for future trainings.

Shane Gliser, Application Security Specialist, American Century Investments


I needed to provide a deep set of training content to developers at my company, especially around secure authorization flows for modern applications. Philippe delivered a comprehensive series on OIDC and OAuth flows and security of modern apps and API's and I couldn't be more happy with this valuable resource for our developers. Thank you so much Dr. Philippe!

Jet Anderson, Code Doctor, Nike

In a nutshell, you should definitely join this course.

FAQ

If you have a question, you will likely find the answer in the list below. If that is not the case, don't hesitate to reach out via email ([email protected]).


Can I subscribe multiple people at once?

Yes, absolutely. Please fill out this Google Form with the details of your order. We will contact you to complete the order process. Note that group licenses for 10 or more attendees are eligible for a 20% volume discount.


Can I receive an invoice for my purchase?

Of course. Due to the complexity of tax rules, we do not handle invoicing on the online platform. After your purchase, we will contact you for invoicing details.


How does the private consulting session in the bundle work?

The bundle with private consulting includes two hours of consulting time with your instructor, Philippe. These two hours are scheduled at your convenience in one or two consulting sessions. In those two hours, you have the opportunity to ask Philippe's advice on specific questions or scenarios.

If you subscribe multiple people at once, you can choose for the consulting add-on as well. In that scenario, all the members of the group purchase are welcome to join the private consulting session.


How long do I have access to the course?

Course subscriptions do not have an expiration date. Registering now gives you permanent access to the live sessions, the recordings of those live sessions, and the remastered recordings when released.


Do you offer discounts?

No, the courses are priced reasonably. If you strictly look at getting the most quality for your money, this course is off the charts (in a good way!), as the depth offered by this course is unparalleled in other offerings.

Note that purchasing the bundle saves you 20% on the price of the individual courses.

Group licenses for 10+ attendees are eligible for a 20% volume discount.