Web Security (OWASP Top 10)

Learn how real websites get hacked — and how to stop it. SQL injection, XSS, CSRF, broken access control, password storage, JWT and API security, explained with pictures and runnable Python demos, mapped to the OWASP Top 10:2025. Defensive, practical and interview-ready.

1. 01Web Security Basics — CIA Triad, Threat Modelling and the OWASP Top 10:2025What "secure" actually means for a web app, how attackers think, how to find your attack surface, and the ten risk categories every developer is expected to know (OWASP Top 10:2025).
2. 02HTTPS, Secure Cookies and Security Headers — The Free Protection Every Site Should Turn OnHow HTTPS protects data in transit, what HttpOnly, Secure and SameSite do on cookies, and the security headers (HSTS, CSP, X-Content-Type-Options, frame-ancestors) that block whole classes of attacks.
3. 03SQL Injection — How Attackers Read Your Whole Database, and the One Fix That Stops ItSee SQL injection happen on a real (SQLite) database in Python — login bypass and data theft with UNION — then fix it with parameterised queries, plus ORM pitfalls and least privilege.
4. 04Cross-Site Scripting (XSS) — Stored, Reflected and DOM XSS, and How to Stop ThemHow one comment box can run an attacker's JavaScript in every visitor's browser, the three types of XSS, and the fixes — output encoding, safe framework defaults, sanitising rich text and Content Security Policy.
5. 05CSRF and CORS — Forged Requests, SameSite Cookies, CSRF Tokens and What CORS Really ProtectsHow a malicious page can make a logged-in user's browser perform actions on your site (CSRF), the defences (SameSite cookies, CSRF tokens, origin checks), and the most misunderstood header in web development — CORS.
6. 06Storing Passwords and Building Safe Login — Hashing, Salts, Rate Limits, MFA and SessionsWhy passwords must never be stored or encrypted, how salted slow hashes (bcrypt, scrypt, Argon2, PBKDF2) work, brute-force and credential-stuffing defences, multi-factor authentication and safe sessions — with Python demos.
7. 07Broken Access Control — IDOR, Privilege Escalation and SSRF (OWASP #1)The number-one web risk explained: changing an ID in the URL to see someone else's data (IDOR), students reaching admin functions, mass assignment, and SSRF — with Python examples of the checks that prevent them.
8. 08JWT and API Security — How Tokens Work, Common JWT Mistakes, Rate Limits and Input ValidationBuild and verify a JWT by hand in Python to see exactly what it protects (integrity) and what it doesn't (secrecy), avoid the classic JWT mistakes, and secure APIs with validation, rate limits and safe error handling.
9. 09Secure Development in Practice — Supply Chain, Secrets, Logging, Error Handling and Security CareersThe remaining OWASP 2025 risks in practice — software supply chain, integrity, logging and alerting, mishandled errors — plus secrets management, security testing tools, a pre-deploy checklist and how to start a career in application security.