Full-Stack Software EngineerIntermediate6 modules~3.0 hours hands-on3 learning modes
Web & API Security
Defend a local notes API against broken access control, injection, SSRF, XSS, CSRF, unsafe errors, and resource abuse using OWASP 2025 and ASVS 5.0.
// What you'll be able to do- Object, function, and property authorization on every request
- Queries, HTML, commands, and deserialization stay in context
- Constrain destinations, redirects, protocols, and local resources
- CSRF, security headers, safe errors, and resource limits
6 modules, built to run
Every module ships runnable code. Expand any one to see what's inside.
00IntroductionSecurity requirements become executable behavior30 min
Questions this module answers
- How do you explain the core security property behind Introduction?
- How can you recognize common failure modes in Introduction?
Start moduleFree preview
01Access Control & API AbuseObject, function, and property authorization on every request30 min
Questions this module answers
- How do you explain the core security property behind Access Control & API Abuse?
- How can you recognize common failure modes in Access Control & API Abuse?
02Injection & Output BoundariesQueries, HTML, commands, and deserialization stay in context30 min
Questions this module answers
- How do you explain the core security property behind Injection & Output Boundaries?
- How can you recognize common failure modes in Injection & Output Boundaries?
03SSRF, Files & Outbound RequestsConstrain destinations, redirects, protocols, and local resources30 min
Questions this module answers
- How do you explain the core security property behind SSRF, Files & Outbound Requests?
- How can you recognize common failure modes in SSRF, Files & Outbound Requests?
04Browser Requests & Failure SafetyCSRF, security headers, safe errors, and resource limits30 min
Questions this module answers
- How do you explain the core security property behind Browser Requests & Failure Safety?
- How can you recognize common failure modes in Browser Requests & Failure Safety?
05Pattern SynthesisBuild a deterministic web request guard30 min
Questions this module answers
- How do you explain the core security property behind Pattern Synthesis?
- How can you recognize common failure modes in Pattern Synthesis?
Ready to start Web & API Security?
Start with the free Module 0, then unlock the full course on a Pro plan.