So you need to defend web apps, do you? This is an intermediate-level #appsec talk that will dive into some of the specifications and emerging defensive strategies of using the HTTP protocol. We will provide you with a broad overview of the protocol and related technologies, then cover proper use of security headers and how to protect sensitive information like session tokens and cookies. For those of you who want to walk the path of the #appsec ninja - or just learn how to best protect your web presence - you must attend! The presentation will include demos of some tools and techniques and provide additional resources for further research.