security

Security

The ways real apps get attacked and how to defend them — safe login and sessions, validating input, and the common mistakes that leak data.

9 units·46 lessons·~39 h

Start track →

00

Start from zero

Before the senior material: what web security even is, and the handful of words the rest of the track assumes you already know.

01 Start from zero: what web security actually is 10 min

01

Owasp modern

Coming soon — Web security

01 The OWASP Top 10 (2021): what changed and why it matters 16 min 02 OWASP Top 10: multiple-choice review 13 min 03 OWASP Top 10: free-recall review 14 min 04 OWASP Top 10: code and config reading 14 min 05 OWASP Top 10: audit and harden a vulnerable service 240 min

02

OAuth 2.1 and OIDC: delegated authorization that does not leak

PKCE everywhere, exact redirect match, refresh rotation, sender-constrained tokens. Skipping any one mandatory check is a CVE.

01 What OAuth is and why passwords are not the answer 7 min 02 Authorization code flow with PKCE 10 min 03 ID token validation and JWKS cache management 9 min 04 Refresh token rotation and scope-based least privilege 9 min 05 Sender-constrained tokens: DPoP and mTLS 11 min 06 OAuth in production: audience attacks, observability, and real failures 11 min 07 OAuth/OIDC: multiple-choice review 13 min 08 OAuth/OIDC: free-recall review 14 min 09 OAuth/OIDC: code review 14 min 10 OAuth/OIDC: build and audit a hardened login 240 min

03

Jwt pitfalls

Coming soon — Web security

01 JWT security pitfalls: alg confusion, no revocation, and where tokens leak 16 min 02 JWT pitfalls: multiple-choice review 13 min 03 JWT pitfalls: free-recall review 14 min 04 JWT pitfalls: code and token reading 14 min 05 JWT pitfalls: break and harden an auth flow 200 min

04

Csrf

Coming soon — Web security

01 CSRF in the SameSite era: why the default helped but didn''''t kill it 16 min 02 CSRF: multiple-choice review 13 min 03 CSRF: free-recall review 14 min 04 CSRF: code and config reading 14 min 05 CSRF: build the exploit, then the defense 220 min

05

Password hashing

Coming soon — Web security

01 Password storage: why a slow, salted, memory-hard KDF is the only safe choice 17 min 02 Password hashing: multiple-choice review 13 min 03 Password hashing: free-recall review 14 min 04 Password hashing: code review 14 min 05 Password hashing: build a migration-safe auth store 220 min

06

Secrets

Coming soon — Web security

01 Secrets management: why a key in git is already a breach 16 min 02 Secrets management: multiple-choice review 13 min 03 Secrets management: free-recall review 14 min 04 Secrets management: code and config reading 14 min 05 Secrets management: climb the maturity ladder 240 min

07

Supply chain

Coming soon — Web security

01 Supply-chain security: your real attack surface is your dependencies 16 min 02 Supply-chain security: multiple-choice review 13 min 03 Supply-chain security: free-recall review 13 min 04 Supply-chain security: config and pipeline reading 14 min 05 Supply-chain security: harden a release pipeline end to end 240 min

08

Putting it together

Coming soon — Web security

01 Defense in depth: the breach lives in the seam 17 min 02 Security capstone: multiple-choice review 13 min 03 Security capstone: free-recall review 14 min 04 Security capstone: code and config reading 14 min 05 Security capstone: threat-model and harden a web app 240 min

Build with this track

Guided projects that exercise what you learn here.

A Next.js app to production

Build a multi-tenant content app on the App Router — then run it: lock down auth and secrets, layer the caches, decide every edge-vs-node call, and work the incident when one tenant poisons a shared ISR page.

Mini OAuth 2.0 + PKCE login

Implement the authorization-code + PKCE flow end to end against a real provider, so you understand every redirect and token instead of trusting a library.

Presigned upload flow

Direct-to-storage uploads via presigned URLs with size/content-type limits and a completion webhook that verifies the object actually arrived — so your API server never touches file bytes.

Distributed rate limiter

Build a token-bucket limiter that holds across many app instances by keeping the counter in Redis, not in process memory.

Threat-Model and Harden a Small App

Take a small app you fully own and run it through the loop a real security engineer lives in: first map how an attacker would actually break it, then close those paths one by one. You build an attack tree against your own service, then fix authentication, authorization, secrets handling, security headers, and input validation — and write down which fix kills which branch of the tree. This is the whole craft of defensive security in miniature: not a checklist, but a chain from threat to mitigation you can defend out loud.

URL shortener at scale

Build a URL shortener that survives real traffic — then run it: deploy it, watch it, and work the incident when one hot link melts your cache.

Observability

How to see what your running system is doing — through logs, metrics, and traces — so that when something breaks at 3am you can actually find out why.