Back to catalog
Web developmentIntermediate

Web Security for Developers

Twelve lessons on the habits that keep injection, broken access control and leaked keys out of the code you write every day

Web Security for Developers

About this course

A security course for people who already write web applications. You know how to query a database and how to put text on a page; this course is about what happens when someone sends you a value you did not expect, and about what you write instead.

Every lesson is built around a pair: the vulnerable version of a piece of code and the fixed one, in JavaScript, Node and PHP, with SQL where it belongs. Injection beyond the database, cross-site scripting in the contexts where escaping differs, password storage with the parameters current guidance actually names, sessions and tokens, the access-control check that is missing from most applications, CSRF, file uploads, redirects and SSRF, secrets and dependencies, logging that does not become a second breach, and error handling that does not narrate your stack to a stranger.

The course follows the OWASP Top 10 and the OWASP Cheat Sheet Series as a map, and the NIST digital identity guidelines for anything to do with passwords. It gives you no reason to invent cryptography or to write an authentication system from scratch — the whole point is that you do not have to.

Course curriculum

  1. Threats and untrusted input

    Who attacks a web application and why, where your trust boundary runs, and why every value that arrived over the network — including headers, cookies and hidden fields — is attacker-controlled until you prove otherwise.

    • 1.Who attacks your application, and why12 min
    • 2.Everything the client sends is untrusted14 min

  2. Injection and cross-site scripting

    One rule behind SQL injection, command injection, template injection and XSS: the moment your code glues text together in another language, whoever controls part of that text controls its grammar. Plus the escaping that depends on where the value lands, and the Content-Security-Policy that catches what you missed.

    • 1.When data becomes code: injection beyond SQL16 min
    • 2.XSS: the context decides the escaping18 min

  3. Authentication, sessions and tokens

    How to store a password so that a stolen database is not a list of logins, how to make the login and reset flows answer without telling an attacker who your users are, and how to carry a session afterwards — where to keep it, how long it lives, and what logging out actually has to do.

    • 1.Storing passwords: slow on purpose16 min
    • 2.Login, brute force and a password reset that says nothing16 min
    • 3.Sessions and tokens: where they live and when they die16 min

  4. Authorisation and requests that cross a boundary

    The most common hole in real applications is not exotic: it is an object fetched by an identifier from the URL without asking whether the caller owns it. Then the requests other sites make on behalf of your user, and the requests your own server makes on behalf of a stranger.

    • 1.Access control: the check that is usually missing16 min
    • 2.CSRF, SameSite and CORS14 min
    • 3.Uploads, redirects and the requests your server makes18 min

  5. Secrets, dependencies and everyday habits

    Keys that end up in the repository, packages nobody read, logs that become a second breach, errors that narrate your stack to a stranger, the small mistakes that cost money — and what to do when a stranger emails you a vulnerability report.

    • 1.Secrets and dependencies16 min
    • 2.Errors, logs, money and the report in your inbox18 min