The labs on this site need JavaScript to run. The same content is written out below.

Learn

Security

Authentication (who you are), authorization (what you are allowed to do), web attacks and defenses, and cryptography.

Authentication

• Sessions and JWT — Where is the login state stored?
• Cookies — Showing a name tag, every time, to a server that cannot remember you
• Password hashing — How well do passwords hold up when the database leaks?
• JWT structure and verification — How does the server trust a token that anyone can read?
• OAuth login flow — What is exchanged when you click "Log in with Kakao"
• Session hijacking and session fixation — Whoever knows the session ID is that user

Authorization

• Security filter chain — Where is it decided whether the response is 401 or 403?
• Access control — If a logged-in user only changes the number in the URL, can they see someone else's order?
• Method security — When does an authorization check on a method run, and when is it skipped?

Web attacks and defenses

• Three web attacks — What happens when you trust input as it is
• CORS — Why a request works in Postman but is blocked only in the browser
• Clickjacking and open redirects — How do you stop your page from being hidden inside another site's page, or your URL from sending users to another site?
• Information leakage — What do error responses and login failure messages tell the outside world?
• Rate limiting — Three meanings of "accept only 5 requests per second"
• Dependencies and the supply chain — How do libraries I never wrote down get into my program, and who decides their versions?

Cryptography

• Hashing, encryption, and signatures — What hides, what checks, and what cannot be undone
• TLS handshake — What happens before the https padlock locks