LEVEL 10 · BACKEND ENGINEERING

Course Core

Security

Protect users and systems: authentication, passwords, sessions and JWTs, OAuth with PKCE, browser attacks and defences, injection and server-side attacks, cryptography and secrets, and why types are not security.

0 of 6 lessons done

Start lesson 1 →

When you finish, you can

  • Store passwords safely and choose between sessions and JWTs
  • Explain the OAuth authorization code flow with PKCE
  • Prevent CSRF, XSS and CORS mistakes, and set security headers
  • Prevent SQL injection, SSRF, path traversal and request smuggling
  • Choose hashing, HMAC or encryption, and manage secrets
  • Explain where compile-time types, runtime validation and security controls each protect you

You build: A security review of the BookStore API, with every finding fixed

MODULE 1

Identity

  1. 1AuthenticationBuild log-in from first principles: Argon2id hashes, hashed session tokens, a hand-made JWT, secure cookies, rotation, logout and brute-force limits.60 min
  2. 2OAuth 2.0 and OpenID ConnectImplement the OAuth code flow with PKCE and OpenID Connect against your own small authorization server, then attack it with forged states and stolen codes.60 min

MODULE 2

Attacks and defences

  1. 3Browser attacks and defencesFind and fix CSRF, CORS mistakes and XSS in small Node.js apps, add a Content-Security-Policy and security headers, and prove every fix with a test.60 min
  2. 4Writing injection-safe codeKeep untrusted data from becoming code: parameterized SQL, argument arrays, confined file paths, outbound URL allow-lists, strict HTTP parsing, safe merges and linear-time regexes.60 min

MODULE 3

Cryptography and trust

  1. 5Cryptography for developersChoose between hashing, HMAC, encryption and signatures by the problem, sign and verify with Ed25519, run TLS locally, and manage and rotate keys safely.55 min
  2. 6Types are not securitySee why a TypeScript type cannot decide who may do what, then build a refund endpoint with runtime validation, explicit authorization, branded ids and unloggable secrets.55 min

Course checkpoint

Prove you can move on. The checkpoint picks 20 questions at random from every lesson in this course. Get 16 right to pass. Your result is saved in this browser only.