Authentication & Security

A security-focused learning path covering authentication, authorization, OAuth2, JWT, session management, password security, CORS, CSP, and common vulnerabilities for secure web applications.

1. 1

   Security Fundamentals

   Understand core security concepts, threat models, and principles

   Completion criteria: Create a threat model for a sample application

   Next step: Learn authentication basics

   ⏱ 6h

2. 2

   Authentication Fundamentals

   Understand session-based vs token-based authentication

   Prerequisites: as-01

   Completion criteria: Implement both session and token authentication

   Next step: Study password security

   ⏱ 6h

3. 3

   Password Security and Hashing

   Implement secure password hashing with bcrypt and argon2

   Prerequisites: as-02

   Completion criteria: Build a secure password storage and verification system

   Next step: Learn JWT

   ⏱ 6h

4. 4

   JSON Web Tokens (JWT)

   Master JWT structure, signing, verification, and best practices

   Prerequisites: as-03

   Completion criteria: Implement JWT auth with refresh tokens

   Next step: Study OAuth2

   ⏱ 8h

5. 5

   OAuth2 and OpenID Connect

   Implement OAuth2 flows and OIDC for third-party auth

   Prerequisites: as-04

   Completion criteria: Build an OAuth2 provider and client with PKCE

   Next step: Learn session management

   ⏱ 10h

6. 6

   Session Management and Cookies

   Implement secure sessions with cookies, CSRF, and fixation protection

   Prerequisites: as-05

   Completion criteria: Build a secure session management system

   Next step: Study authorization

   ⏱ 8h

7. 7

   Authorization and Access Control

   Implement RBAC, ABAC, and resource-level authorization

   Prerequisites: as-06

   Completion criteria: Build a fine-grained authorization system

   Next step: Learn CORS and CSP

   ⏱ 8h

8. 8

   CORS and Content Security Policy

   Configure CORS and CSP headers for web security

   Prerequisites: as-07

   Completion criteria: Configure secure CORS and CSP for a web application

   Next step: Study OWASP vulnerabilities

   ⏱ 6h

9. 9

   OWASP Top 10 Vulnerabilities

   Understand and prevent the OWASP Top 10 web vulnerabilities

   Prerequisites: as-08

   Completion criteria: Audit an application for OWASP Top 10 vulnerabilities

   Next step: Learn secure headers

   ⏱ 10h

10. 10

    Security Headers and HTTPS

    Implement security headers, HTTPS, and TLS best practices

    Prerequisites: as-09

    Completion criteria: Configure comprehensive security headers for an app

    Next step: Study API security

    ⏱ 6h

11. 11

    API Security and Rate Limiting

    Secure APIs with rate limiting, input validation, and API keys

    Prerequisites: as-10

    Completion criteria: Add comprehensive security measures to an API

    Next step: Build a capstone security project

    ⏱ 6h

12. 12

    Capstone Security Project

    Build a fully secured web application with auth and protection

    Prerequisites: as-11

    Completion criteria: Deliver a security-audited application with full auth and protection

    Next step: Explore zero-trust architecture and advanced security topics

    ⏱ 10h