Intermediate
Application Security
The parts you are personally responsible for.
Authentication and authorization as concepts, password storage, sessions versus tokens, JWT done right, OAuth2 flows, the OWASP Top 10 as it applies to a Java API, secrets management, and API security beyond auth.
7 lessons written1 modules~1h reading
After this course you can
- Store passwords and sessions correctly and explain the alternatives
- Find and fix the OWASP Top 10 issues in a Spring service
- Handle secrets so they never reach a log, a repo or a container image
Curriculum
7 lessons · outlined lessons show their plan01
Authentication and authorizationWho you are versus what you may do, password hashing with bcrypt or Argon2, sessions versus tokens, MFA, and account enumeration.12 minPassword storageWhy a fast hash is the wrong tool, what salt and a work factor each buy, and the bcrypt string that carries both inside it.12 minSessions and tokensStateful versus stateless, the revocation you give up with a JWT, access and refresh tokens, and where a browser should keep one.13 minInjectionWhy a concatenated query returns every row, why parameters work where escaping does not, and the identifiers placeholders cannot cover.13 minOWASP Top 10 for Java APIsInjection, broken access control, SSRF, insecure deserialisation, mass assignment, and the dependency with the CVE — each with the Spring-specific fix.14 minSecrets and API securityVaults, rotation, environment variables and their limits, TLS everywhere, mTLS between services, and rate limits as security.10 minDependencies and the supply chainFifteen declared packages become 515, and four starters become 61 jars — each running with your privileges. Reachability, lockfiles, and the question Log4Shell was really about.12 min