Application Security: Step by Step

Headers and cookies, the OWASP Top 10, injection and XSS, access control, API security, supply chain, and automated testing.

7 lessons · about 69 minutes of reading

Log in to track your progress through this course.

1. 1

   HTTP Security Headers, Secure Cookies, and Content Security Policy

   Harden a web application with the right response headers, cookie attributes, and a strict Content Security Policy.

   10 min read

2. 2

   The OWASP Top 10:2025 Explained for Developers

   Walk through all ten categories of the 2025 edition, what changed from 2021, and the core defense for each.

   11 min read

3. 3

   Preventing SQL Injection and Cross-Site Scripting (XSS)

   Use parameterized queries, allow-lists, context-aware output encoding, and safe DOM APIs to remove the two classic injection flaws.

   10 min read

4. 4

   Broken Access Control, CSRF, and Session Management

   Enforce server-side authorization, block cross-site request forgery, and manage sessions securely using OWASP's guidance.

   10 min read

5. 5

   API Security: The OWASP API Security Top 10 (2023)

   Understand the ten most critical API risks, and the practical controls that prevent object-level flaws, excess data, and abuse.

   9 min read

6. 6

   Dependency and Supply Chain Security: SCA, SBOMs, and Scanning

   Find known vulnerabilities in your dependencies with Dependabot, OSV-Scanner, and Trivy, and scan your own Python code with Bandit.

   9 min read

7. 7

   Automated Security Testing with OWASP ZAP Against a Local Practice App

   Run ZAP's baseline scan in Docker against OWASP Juice Shop on a private network, read the report, and add it to CI safely.

   10 min read