Web Security is a practical course designed to help trainees understand how modern web attacks happen and how to protect websites and web applications. This course focuses on the most common vulnerabilities used by attackers and the security best practices developers must follow.

You will learn how to identify real-world web security risks such as weak authentication, insecure inputs, session issues, and misconfigurations, and you will practice applying secure coding and security checks to reduce risk in modern web applications.

This course emphasizes thinking like both a defender and a tester: you will learn how attacks work (at a safe, controlled level), how to detect them, and how to fix them using secure design patterns and configuration hardening.

Learning format: This course does not require live class attendance. Course content unlocks weekly by topics, allowing trainees to study tutorials on their own schedule. Unlocked topics include assignments or projects that must be completed and submitted before their deadlines. The instructor provides weekly announcements, feedback, and reminders outlining the topics and tasks to be completed for that week.

By the end, you will be able to:

• Explain the OWASP Top 10 risks and how they show up in real applications.
• Harden authentication and access control (sessions, roles, permissions).
• Prevent common injection issues (SQL injection, command injection) with safe patterns.
• Reduce XSS, CSRF, and security header risks using modern browser protections.
• Secure APIs (auth, rate limiting, input validation, CORS) and avoid common API mistakes.
• Perform basic security testing and write a simple remediation plan.