Course
Secure Coding in Practice
Write code attackers can't bend: validate and encode untrusted input, kill injection with parameters, handle passwords, sessions and authorization correctly, avoid the classic crypto mistakes, and shut down SSRF, path traversal and unsafe deserialization — with fixes in Python, JavaScript, PHP and Java and graded challenges for every lesson.
Reviews
Enrolled members can rate this course.
No reviews yet.
Untrusted Input
Find every trust boundary, then stop injection and XSS at the source.
- 01Trust boundaries: every input is hostile until proven otherwiseMap where untrusted data enters, and apply validate → normalize → encode in the right places.15mOpen
- 02Injection: parameters for SQL, argument arrays for commandsWhy string-built queries and shell commands get owned, and the one fix that works in every language.20mOpen
- 03Output encoding and XSS: render data, never markupContext-aware escaping, safe templating, and CSP as the second wall.20mMembers
Identity, Sessions and Secrets
Passwords, cookies, authorization checks and the crypto mistakes that undo them.
- 01Passwords and sessions done rightSlow hashes, rate limits, session rotation and the cookie flags that matter.20mMembers
- 02Authorization: check the object, not just the loginIDOR, deny-by-default, and pushing access rules down to the database.18mMembers
- 03The crypto mistakes that keep shippingWeak randomness, unauthenticated encryption, nonce reuse, timing leaks, and what to use instead.22mMembers
Hostile URLs, Files and Formats
SSRF, path traversal, uploads, deserialization and the dependencies you didn't write.
- 01SSRF and URL handling: don't let users aim your serverWhy string checks on URLs fail, the IP tricks attackers use, and a fetch that holds up.22mPremium
- 02Path traversal and file uploadsResolve-then-check, safe storage names, and validating files by their bytes.20mPremium
- 03Unsafe deserialization and the code you didn't writeWhy pickle and unserialize are remote code execution, and how to keep dependencies honest.20mPremium