← Noesa

Web Security, day by day

For A web developer who ships apps and wants to recognize the OWASP Top Ten, understand each attack, and apply concrete defensive fixes — no security background needed. · 18 days · Tech

A 18-day course
One short lesson a day · go at your own pace
Log in to start
The days
Listen to the whole course · 89 min
  1. 0Set up your security benchBy the end you can open an interactive lab, name the four parts of a safe security review, and state the rule that all testing stays on systems you own. Listen · 5 min
  2. 1Map threats to trust boundariesBy the end you can read the OWASP Top Ten as a map of broken trust boundaries in Petals. Listen · 5 min
  3. 2Bind data into SQLBy the end you can reproduce SQL injection in the lab below and fix it with a parameterized query. Listen · 5 min
  4. 3Separate input from interpretersBy the end you can recognize injection as a family and apply parameters, structured APIs, or allowlists to non-SQL interpreters. Listen · 5 min
  5. 4Render text, not scriptBy the end you can distinguish reflected and stored XSS in Petals and fix the server-rendered path with safe rendering. Listen · 5 min
  6. 5Use safe DOM sinksBy the end you can reproduce DOM XSS in local Petals and fix it with safe sinks and context-aware output handling. Listen · 5 min
  7. 6Constrain scripts with CSPBy the end you can read a Content Security Policy header, add a starter policy, and watch the browser enforce it against a live payload. Listen · 5 min
  8. 7Respect the same originBy the end you can explain scheme, host, and port as an origin and predict which cross-origin actions the browser blocks or allows. Listen · 5 min
  9. 8Harden session cookiesBy the end you can read Set-Cookie attributes and configure HttpOnly, Secure, SameSite, Path, and host scoping for Petals. Listen · 5 min
  10. 9Require intent for state changesBy the end you can reproduce CSRF on local Petals and fix it with SameSite plus a server-validated CSRF token. Listen · 5 min
  11. 10Return JSON as dataBy the end you can explain XSSI and harden Petals JSON endpoints against script inclusion and JSON hijacking patterns. Listen · 5 min
  12. 11Manage authentication sessionsBy the end you can identify common authentication and session failures and harden Petals login, logout, and password storage behavior. Listen · 5 min
  13. 12Authorize every objectBy the end you can reproduce an IDOR in local Petals and fix it with server-side, per-object authorization. Listen · 5 min
  14. 13Allow only safe server fetchesBy the end you can explain SSRF and harden a Petals URL fetcher with allowlists, parser discipline, and network blocks. Listen · 5 min
  15. 14Deserialize only trusted dataBy the end you can explain insecure deserialization and replace native object restore with signed, schema-validated data. Listen · 5 min
  16. 15Break code-execution chainsBy the end you can explain RCE as a chain outcome and list the layers that stop Petals from turning input into server code execution. Listen · 5 min
  17. 16Use cryptography through librariesBy the end you can identify cryptographic failures in Petals and choose library-backed password hashing, TLS, random tokens, and secret handling. Listen · 5 min
  18. 17Harden Petals for releaseBy the end you can run a defensive hardening review over Petals and produce an OWASP-style secure-coding checklist for your own app. Listen · 5 min