Web Security Tutorial with Examples.
Web security tutorial for the OWASP Top 10, fix-side: broken access control, CSRF, SSRF, file uploads, misconfiguration and brute-force logins, each test-pinned.
Beginner
Start here — no prior experience needed
Broken Access Control and IDOR: Fix It in Code, Pin It with a Test
A Flask API leaks another user's invoice. Add the ownership check that fixes it, and a pytest sweep that catches the next route to forget the check.
CSRF: Synchronizer Tokens and SameSite Cookies, Fixed and Tested
A logged-in user's cookie lets a forged POST move money. Add a per-session CSRF token, set SameSite=Lax, and pin both with a failing-then-passing pytest.
Security Misconfiguration: Error Pages, Debug Mode and Security Headers
A Flask error page leaks a stack trace and a database password. Replace it with a generic handler, add security headers, and pin both with pytest.
Intermediate
For developers with core concepts down
SSRF: Allowlists, Resolved-IP Checks and No Redirects
A link-preview endpoint fetches an internal admin page for anyone. Fix it with a host allowlist, resolved-IP checks and no redirects, under pytest.
Unsafe File Uploads: secure_filename, Allowlists and Size Limits
A Flask avatar upload writes outside its folder and accepts any file. Fix it with secure_filename, an extension allowlist and MAX_CONTENT_LENGTH.
Authentication Failures: Username Enumeration and Login Rate Limiting
A Flask login reveals which usernames exist and allows unlimited guesses. Fix it with one generic error, equal timing and a per-account attempt limit.
Also part of Web Security (OWASP Top 10, fix-side)
Taught in other topics. Each link opens the lesson in its home topic.
Python Security
Run real attacks against local Python code and fix them: SQL injection, shell injection, path traversal, weak tokens and password hashes.
Database Security
Secure PostgreSQL with real output: roles, GRANT and REVOKE, column privileges, the locked public schema, row-level security, and SQL injection.
JavaScript Security Best Practices
Learn how to protect JavaScript applications from XSS, CSRF, prototype pollution, insecure JWT handling, and other common web security vulnerabilities.
Java Security
Secure Java coding by running it: allowlist validation, SQL injection vs PreparedStatement, PBKDF2 hashing, SecureRandom, AES-GCM and KeyStore.
Bash Security Best Practices
Write secure Bash scripts — safe temp files with mktemp, avoiding command injection, handling secrets, and setting file permissions.
FastAPI Authentication: Password Hashing, OAuth2 and JWT
Hash passwords with pwdlib and Argon2, log in through FastAPI's OAuth2 password flow, issue JWTs, and see wrong, expired and tampered tokens get 401s.
FastAPI Roles, CORS and Settings from Environment Variables
Guard FastAPI routes with role dependencies, run real CORS preflights that pass and fail, and load config from env vars and .env with pydantic-settings.
Spring Security — Authentication and Authorization
Secure a Spring Boot 3 API and probe it with curl: default lockdown, SecurityFilterChain rules, BCrypt, 401 vs 403, @PreAuthorize and tests.
Testing Bearer Tokens, Basic Auth, and 401 vs 403
Extend the local test API with two auth schemes and catch the assumption that 'wrong token' and 'no token' return the same status code — they don't, and mixing them up hides real bugs.
C Secure Coding: Buffer Overflows, Sanitizers, and Safe Functions
Catch C memory bugs before they ship: AddressSanitizer, _FORTIFY_SOURCE, stack canaries, -Wformat-security, and safe snprintf, fgets and overflow checks.
LLM Security Beyond Guardrails
Indirect prompt injection, excessive agency, and insecure output handling — the OWASP-style risks that survive input/output guardrails.
Dependency Scanning (SCA) and SBOMs with pip-audit, Syft and Grype
Pin an old requests release, read the advisories pip-audit reports, build a CycloneDX SBOM with Syft, scan it with Grype, then bump the pin to a clean run.