Web › Module 5 › Lesson 5
Lab — Defense Checklist
Run a defensive checklist against your staging site or local app—headers, cookies, access control spot checks
Opening
Think like a defender with a clipboard
Offense teaches what breaks; defense verifies what is fixed. This lab is a structured review of your own staging environment or a locally running app—never unsolicited scanning of third-party domains.
1. Step 1 — Header audit
Collect security headerscurl -sI https://staging.yourdomain.example -o headers.txt grep -iE "strict-transport|content-security|x-frame|x-content-type|referrer-policy" headers.txt
curl -sI https://staging.yourdomain.example -o headers.txt grep -iE "strict-transport|content-security|x-frame|x-content-type|referrer-policy" headers.txt
Score yourself: Is HSTS present? Is there CSP or Report-Only CSP? X-Frame-Options or frame-ancestors? Note one missing header and draft a one-line fix.
2. Step 2 — Cookie review
After login in browser DevTools → Application → CookiesCheck session cookie flags: HttpOnly: yes/no Secure: yes/no SameSite: Lax/Strict/None Document one improvement (e.g., add Secure on staging HTTPS).
Check session cookie flags: HttpOnly: yes/no Secure: yes/no SameSite: Lax/Strict/None Document one improvement (e.g., add Secure on staging HTTPS).
3. Step 3 — Access control spot test
Two test accounts on YOUR app# Log in as userA, capture GET /api/resource/{id} for own object # Log in as userB, replay userA object ID # Expect: 403 or 404 — not userA data curl -H "Authorization: Bearer <userB_token>" \\ https://staging.yourdomain.example/api/resource/USERA_ID
# Log in as userA, capture GET /api/resource/{id} for own object
# Log in as userB, replay userA object ID
# Expect: 403 or 404 — not userA data
curl -H "Authorization: Bearer <userB_token>" \\
https://staging.yourdomain.example/api/resource/USERA_ID4. Step 4 — Dependency quick scan
Example: npm audit or pip-audit in your projectcd your-app && npm audit --audit-level=high # or: pip-audit -r requirements.txt
cd your-app && npm audit --audit-level=high # or: pip-audit -r requirements.txt
Complete defense checklist lab
Audit headers on an authorized staging/local URL, review session cookie flags after login, perform one horizontal access control test between two lab accounts, and run one dependency audit command. Write three findings (even if all pass).
Knowledge Check
This defense lab should target:
Multiple choice
Knowledge Check
True or False: A horizontal access test checks whether user B can read user A's objects.
True or False