FREE COURSE / REAL PRACTICE
Web application security foundations
Reason about request, identity, data and output boundaries with deterministic Python policy fixtures and real in-memory SQLite.
What you’ll work toward
Validate and encode for explicit contexts, bind SQL values, enforce tenant/object permissions, model session/CSRF and upload boundaries, and test a local service policy without claiming production security.
Read an explanation, inspect the diagrams and work through the available checks, debugging exercises and builds. Feedback and prerequisite links guide the next step.
Before you start
This course builds on these skills:
- Functions, control flow & contracts
- Collections, grouping & deterministic order
- Exceptions, resources & honest failures
Individual lessons can add prerequisites. The course map shows your actual readiness.
A look inside the first lesson
Trust boundaries, validation & output contexts
from html import escape
comment = 'Mina & Jo <3'
print('<p>' + escape(comment, quote=True) + '</p>')Your course outline
Follow the lessons in curriculum order. Open a unit to preview the ideas you’ll work with.
Security: trust, queries and object authority
- LESSON 01.01
Trust boundaries, validation & output contexts
Validate a canonical request identifier while preserving legitimate comment text and encoding it for one explicit HTML context.
Open lesson - LESSON 01.02
SQL values, query structure & tenant scope
Execute real SQLite lookups with bound values, fixed sort choices and a tenant predicate that parameter binding alone cannot supply.
Open lesson - LESSON 01.03
Authenticated identity & object authorization
Apply a deny-by-default policy to each object using active identity, tenant, role, ownership and requested action.
Open lesson
Security: sessions, files and safe diagnostics
- LESSON 02.01
Session lifetime, cookie policy & CSRF
Model expiry and revocation, format a constrained host cookie, and require a session-bound CSRF token for state-changing methods.
Open lesson - LESSON 02.02
Upload metadata, byte limits & storage keys
Validate a small UTF-8 text-upload policy while separating untrusted display filenames from server-assigned canonical storage keys.
Open lesson - LESSON 02.03
Safe error contracts & allowlisted audit events
Return stable public errors and deterministic structured audit events that omit secrets and reject untrusted correlation syntax.
Open lesson