---
title: "Security — ZudoJS Academy"
description: "Protect users and systems: authentication, passwords, sessions and JWTs, OAuth with PKCE, browser attacks and defences, injection and server-side attacks, cryptography and secrets, and why types are not security."
source: https://zudojs.oyinlola.site/learn/security
---

LEVEL 10 · BACKEND ENGINEERING

Course Core

# Security

Protect users and systems: authentication, passwords, sessions and JWTs, OAuth with PKCE, browser attacks and defences, injection and server-side attacks, cryptography and secrets, and why types are not security.

- **6 lessons**
- **6 h** to read and try
- **Before this:** [Backend engineering](https://zudojs.oyinlola.site/learn/backend)

0 of 6 lessons done

[Start lesson 1 →](https://zudojs.oyinlola.site/learn/sec-authentication)

## When you finish, you can

- Store passwords safely and choose between sessions and JWTs
- Explain the OAuth authorization code flow with PKCE
- Prevent CSRF, XSS and CORS mistakes, and set security headers
- Prevent SQL injection, SSRF, path traversal and request smuggling
- Choose hashing, HMAC or encryption, and manage secrets
- Explain where compile-time types, runtime validation and security controls each protect you

**You build:** A security review of the BookStore API, with every finding fixed

MODULE 1

## Identity

1. [1**Authentication**Build log-in from first principles: Argon2id hashes, hashed session tokens, a hand-made JWT, secure cookies, rotation, logout and brute-force limits.60 min](https://zudojs.oyinlola.site/learn/sec-authentication)
2. [2**OAuth 2.0 and OpenID Connect**Implement the OAuth code flow with PKCE and OpenID Connect against your own small authorization server, then attack it with forged states and stolen codes.60 min](https://zudojs.oyinlola.site/learn/sec-oauth)

MODULE 2

## Attacks and defences

1. [3**Browser attacks and defences**Find and fix CSRF, CORS mistakes and XSS in small Node.js apps, add a Content-Security-Policy and security headers, and prove every fix with a test.60 min](https://zudojs.oyinlola.site/learn/sec-web)
2. [4**Writing injection-safe code**Keep untrusted data from becoming code: parameterized SQL, argument arrays, confined file paths, outbound URL allow-lists, strict HTTP parsing, safe merges and linear-time regexes.60 min](https://zudojs.oyinlola.site/learn/sec-injection)

MODULE 3

## Cryptography and trust

1. [5**Cryptography for developers**Choose between hashing, HMAC, encryption and signatures by the problem, sign and verify with Ed25519, run TLS locally, and manage and rotate keys safely.55 min](https://zudojs.oyinlola.site/learn/sec-crypto)
2. [6**Types are not security**See why a TypeScript type cannot decide who may do what, then build a refund endpoint with runtime validation, explicit authorization, branded ids and unloggable secrets.55 min](https://zudojs.oyinlola.site/learn/ts-security)

## Course checkpoint

Prove you can move on. The checkpoint picks 20 questions at random from every lesson in this course. Get 16 right to pass. Your result is saved in this browser only.