Web Development · Advanced level

Advanced level · Module 2 of 6 · 24 guided hours

Authentication and Web Security

Implement secure login, sessions and role-based access, and defend web applications against the most common attacks.

Learning objectives

  • Store passwords safely and implement session-based login
  • Protect routes with authorisation rules
  • Defend against XSS, CSRF, injection and other common risks

Topics

  • password hashing (bcrypt, argon2)
  • sessions and secure cookies
  • token-based auth trade-offs
  • role-based access control
  • OWASP Top 10
  • security headers and HTTPS
  • secrets management

Lessons

  1. Lesson 1 Passwords and Login

    Store passwords with a slow hashing algorithm and build a login flow that does not leak information.

    password hashingsaltcredential stuffingrate limiting

  2. Lesson 2 Sessions, Cookies and Authorisation

    Keep users logged in with secure session cookies and protect routes and data by role.

    sessionHttpOnly, Secure and SameSite cookiesauthorisation middlewaretokens vs sessions

  3. Lesson 3 Common Web Attacks and Defences

    Recognise the most common web vulnerabilities and apply the standard defences.

    OWASP Top 10XSSCSRFbroken access control

  4. Lesson 4 HTTPS, Security Headers and Secrets

    Harden deployments with HTTPS, security headers and proper secrets management, and keep dependencies up to date.

    HTTPS and HSTSContent-Security-Policysecrets managementdependency updates

Practical activity

Add staff login with roles to the booking platform and run a structured security review against an OWASP-based checklist.

Expected outcomes

  • Secure authentication and authorisation
  • A security review habit

Assessment

Security review of a provided application: find and fix seeded vulnerabilities with evidence.

Taught live by an instructor — online or in person. Free course lessons are for self-study and do not lead to a certificate — see registration options.