Course Outline

? Day 1: Security Foundations and Threat Awareness

Session 1: Introduction to Web Security

• The importance of security in web development
• Threat landscape: OWASP Top 10 overview
• Risk assessment and threat modeling basics

Session 2: Common Vulnerabilities and Exploits

• SQL Injection and NoSQL Injection
• Cross-Site Scripting (XSS): stored, reflected, and DOM-based
• Cross-Site Request Forgery (CSRF) attacks

Session 3: Secure Coding Practices

• Input validation and sanitization techniques
• Output encoding and escaping strategies
• Safe handling of file uploads and query parameters

Lab Activities:

• Perform vulnerability scans on a sample web app
• Simulate SQL injection and XSS attacks in a test environment
• Refactor insecure code using proper sanitization and escaping

? Day 2: Authentication, Authorization, and Session Management

Session 1: Secure Authentication Mechanisms

• Password storage best practices (bcrypt, Argon2)
• Multi-factor authentication (MFA) implementation
• OAuth 2.0 and OpenID Connect fundamentals

Session 2: Authorization and Access Control

• Role-based and attribute-based access control
• Principle of least privilege and secure API access
• Preventing horizontal and vertical privilege escalation

Session 3: Session Management and Tokens

• Secure cookie handling and same-site policies
• JWT (JSON Web Tokens): usage and risks
• Preventing session fixation and hijacking

Lab Activities:

• Implement secure user authentication and token-based access
• Configure access controls and role validation in routes
• Mitigate session-related attacks with secure cookies and token refresh

? Day 3: Secure Architecture, HTTPS, and Deployment

Session 1: Secure Application Architecture

• Defense-in-depth and layered security
• Secure API design and rate limiting
• Microservices vs monolith security considerations

Session 2: HTTPS, CORS, and Secure Headers

• TLS/SSL certificates and HTTPS best practices
• Configuring CORS securely
• Using HTTP security headers (HSTS, CSP, X-Frame-Options)

Session 3: Monitoring, Logging, and Compliance

• Logging security events and avoiding sensitive data exposure
• Real-time monitoring tools and alerts
• Security in DevOps: secrets management and CI/CD

Lab Activities:

• Harden an app using secure HTTP headers
• Set up HTTPS and test for downgrade attacks
• Implement basic audit logging and secret scanning in a CI/CD pipeline