CSE 361, Web Security, Spring 2024

Lecturer:

Nick Nikiforakis

Teaching Assistants:

Narong Chaiwut (nchaiwut[at sign here]cs.stonybrook.edu)

Aditya Patwardhan (aapatwardhan[at sign here]cs.stonybrook.edu)

Time:

Tuesdays and Thursdays, 2:30 PM - 3:50 PM

Place:

Computer Science 2120

Office Hours:

Tuedays	4:00 PM - 5:00 PM, NCS 361
Fridays	3:00 PM - 4:00 PM, NCS 361

Contact:

nick[email squiggly thingy] cs.stonybrook.edu
Important: When sending me an email about the course, make sure your title starts with "[CSE 361]" (without the quotes). Mislabeled or unlabeled emails will, most likely, not be read.

News

Please subscribe to Piazza.

Class Description

In this class, we will together explore the concepts behind web security. We will look at the core principles behind secure (and insecure) web applications, how to both discover vulnerabilities, as well as how to correct them.

The course will consist of lectures, individual assignments, and group assignments.

Some of the topics that we will cover are the following:

History of Web and Web security
Overview of client-side technologies related to Web security
Authentication on the Web
Cross-domain communication
Attacks on Same-Origin Policy
Internals of Content Security Policy
Client-side vulnerabilities (XSS, CSRF, etc.) and Defenses
Interaction between DNS and Web security
Server-side vulnerabilities (SQL injection, RCEs, etc.) and Defenses
Network-level and application-level Denial of Service (DoS) attacks
Server-hardening techniques
Other advanced topics as time allows

Textbook

Following a long-standing tradition in security courses, there is no official textbook for this course. If you like having a book as a reference, you can get a copy of the Web Application Security book by Andrew Hoffman.

Requirements and Grading

Subject to minor tweaks throughout the semester.

Individual Assignments: 15% These will mostly include paper summaries and perhaps small individual programming tasks.
Group Assignments: 25% Semester-long group project on gradually securing a vulnerable web application
Midterm: 25% Brief, in class exam, covering about half of the lectures and studied papers
Final: 35% Final Exam on everything covered in this class

Class Schedule

The list available below includes all topics and slides discussed during this course. Announcements regarding assignments, projects, and exams are only available via Piazza and Blackboard.

Date Topic

1/23 Introduction and History of the Web

1/25 Introduction and History of the Web (continued from last lecture)

1/30 Client-side technologies

2/1 Authentication

2/6 Authentication (continued from last lecture)

2/8 Authentication (continued from last lecture)

2/13 Class cancelled due to inclement weather

2/15 Authentication (continued from last lecture)

2/20 Cross-domain communications

2/22 Cross-domain communications (continued from last lecture)

2/27 Attacking the Same-Origin Policy

2/29 Attacking the Same-Origin Policy (continued from last lecture)

3/05 Content Security Policy and Framing Attacks

3/07 Instructor away on travel.

3/12 Spring break

3/14 Spring break

3/19 Midterm recap

3/21 Midterm (in class)

3/26 Content Security Policy and Framing Attacks (continued from last lecture)

3/28 CSRF, XSSI, SRI, and Sandboxing

4/02 CSRF, XSSI, SRI, and Sandboxing (continued from last lecture)

4/04 Database (in)security

4/09 Database (in)security (continued from last lecture)

4/11 Code Execution Flaws

4/16 Code Execution Flaws (continued from last lecture)

4/18 Assorted Server-side issues

Misc

Remote/Online learning: Students are expected to attend every class, report for examinations and submit major graded coursework as scheduled. If a student is unable to attend lecture(s), report for any exams or complete major graded coursework as scheduled due to extenuating circumstances, the student must contact the instructor as soon as possible. Students may be requested to provide documentation to support their absence and/or may be referred to the Student Support Team for assistance. Students will be provided reasonable accommodations for missed exams, assignments, or projects due to significant illness, tragedy or other personal emergencies. In the instance of missed lectures or labs, the student is responsible for studying all missed content and completing make-up assignments, in consultation with the instructor. Please note, all students must follow Stony Brook, local, state and Centers for Disease Control and Prevention (CDC) guidelines to reduce the risk of transmission of COVID. For questions or more information click here.

Note: If you have a physical, psychological, medical or learning disability that may impact on your ability to carry out assigned course work, please contact the staff in the Student Accessibility Support Center, located at Stony Brook Union, Suite 107, 631-632-6748. The center will review your concerns and determine with you what accommodations are necessary and appropriate. All information and documentation of disability are confidential. For more information, please visit their website: https://www.stonybrook.edu/commcms/studentaffairs/sasc/

Note: Each student must pursue his or her academic goals honestly and be personally accountable for all submitted work. Representing another person's work as your own is always wrong. Any suspected instance of academic dishonesty will be reported to the Academic Judiciary. For more comprehensive information on academic integrity, including categories of academic dishonesty, please refer to the academic judiciary website at http://www.stonybrook.edu/uaa/academicjudiciary/.

Date	Topic
1/23	Introduction and History of the Web
1/25	Introduction and History of the Web (continued from last lecture)
1/30	Client-side technologies
2/1	Authentication
2/6	Authentication (continued from last lecture)
2/8	Authentication (continued from last lecture)
2/13	Class cancelled due to inclement weather
2/15	Authentication (continued from last lecture)
2/20	Cross-domain communications
2/22	Cross-domain communications (continued from last lecture)
2/27	Attacking the Same-Origin Policy
2/29	Attacking the Same-Origin Policy (continued from last lecture)
3/05	Content Security Policy and Framing Attacks
3/07	Instructor away on travel.
3/12	Spring break
3/14	Spring break
3/19	Midterm recap
3/21	Midterm (in class)
3/26	Content Security Policy and Framing Attacks (continued from last lecture)
3/28	CSRF, XSSI, SRI, and Sandboxing
4/02	CSRF, XSSI, SRI, and Sandboxing (continued from last lecture)
4/04	Database (in)security
4/09	Database (in)security (continued from last lecture)
4/11	Code Execution Flaws
4/16	Code Execution Flaws (continued from last lecture)
4/18	Assorted Server-side issues