Authentication and Web Security: The Practical OWASP Course
Authentication and Web Security (OWASP) is an advanced-level course of 5 lessons (about 3 h 24 min), with 15 exercises and 15 quiz questions. Prerequisites: HTTP and REST APIs. The course needs a full project environment, planned for a later phase of the platform.
- Back-end
- Advanced
- 5 lessons
- 3 h 24 min
- 15 exercises
- Full project environment (phase 2)
The course in brief
This advanced course teaches you to recognize and fix the most critical vulnerabilities of web applications, based on the OWASP Top 10 2025. You will write runnable Node.js code: parameterized queries, HTML escaping, scrypt hashing, signed tokens, secure cookies, access control, and HTTP headers. The final project consists of auditing and hardening a complete authentication API.
What you will be able to do
- Explain the categories of the OWASP Top 10 2025 and link them to concrete code
- Prevent SQL and command injection with parameterized queries and allowlists
- Neutralize XSS with contextual escaping, URL validation, and a CSP
- Store and verify passwords with scrypt, a salt, and a constant-time comparison
- Manage sessions, signed tokens, and secure cookies, and protect against CSRF
- Set up server-side access control, security headers, and restrained error handling
Syllabus: 5 lessons
- Place the main risk families of the OWASP Top 10 2025
- Explain the mechanism of a SQL injection
- Write parameterized queries and allowlists for identifiers
- 02
XSS: Escaping HTML and Setting a CSP
- Distinguish stored, reflected, and DOM-based XSS
- Correctly escape data inserted into HTML
- Limit the impact of an XSS with a Content-Security-Policy and URL validation
- 03
Storing Passwords: Hashing with scrypt
- Explain why you hash (and don't encrypt) a password
- Hash and verify a password with crypto.scrypt and a random salt
- Compare secrets in constant time and slow down brute force
- 04
Sessions, Signed Tokens, and Secure Cookies
- Generate unpredictable session identifiers
- Sign and verify a token with HMAC (the principle behind HS256 JWTs)
- Configure HttpOnly, Secure, and SameSite cookies and protect against CSRF
- 05
Access Control, Security Headers, and Error Handling
- Apply server-side access control (role and resource ownership)
- Set the essential HTTP security headers
- Handle errors without disclosing information and log security events
Final project
Audit and Harden an Authentication API
You are given a small, deliberately vulnerable Express API (signup, login, a "my orders" area): concatenated SQL queries, SHA-256 passwords, a token in localStorage, an order route with no ownership check, errors returning the stack trace. Identify each flaw, map it to an OWASP Top 10 2025 category, fix it, and prove the fix with tests.
Deliverables
- An audit report listing each vulnerability, its OWASP category, its impact, and its fix
- The fixed code: parameterized queries, scrypt hashing, secure session cookie, authorization middleware, headers, and error handler
- A node:test suite proving that the described attacks fail (injection, IDOR, forged token, XSS)
- A short secure deployment guide (environment variables, HTTPS, secret rotation)
Assessment criteria
- All the introduced vulnerabilities are identified and correctly classified
- The fixes follow the best practices seen in the course and do not break functionality
- The tests cover the attack cases and pass
- No secret or sensitive data appears in the code, the logs, or the error responses
- The report is clear and understandable by a non-specialist
Frequently asked questions
What level do I need for this web security course?
You need to be able to write a simple HTTP API (course B1) and read JavaScript. The course is advanced, but each vulnerability is explained from a concrete example.
Does the course cover the OWASP Top 10 2025?
Yes. It presents the ten categories of the 2025 edition and goes deeper into those that most affect a developer's code: access control, configuration, cryptography, injection, authentication, logging, and error handling.
Do I need to install tools to do the exercises?
No. The exercises run on the platform with Node.js and its native modules, such as node:crypto. The examples also show the Express code and the libraries used in production.
Which method should I use to store passwords?
A slow, salted hash function such as Argon2id, scrypt, or bcrypt, with a constant-time comparison. The course has you implement the scrypt version available in Node.js.
This course, told for your job
Say what you want to be able to do: “Authentication and Web Security (OWASP)” takes its place in your path, with examples from your field. The concepts stay those of the course.