Web Security with Python
Take a working web service and make it hard to abuse. You will store passwords so a leak does not reveal them, keep sessions and signed tokens that cannot be forged, validate what a request may ask for, stop cross-site requests, answer CORS correctly because you know what a browser checks, and keep secret keys out of your source. You run every attack against your own server and prove every fix with a test.
You need HTTP with Python first: a JSON API written as a handle(request, state) function, cookies and a server-side session, Basic and bearer authentication, and tests that call the handler directly. Python Fundamentals II helps but is not required: you read a few classes and never write one.
Every attack targets your own code, on the loopback address or in memory; the sandbox has no internet and no browser. The browser rules behind CSRF and CORS are a small model that you write yourself. One project, the reading list from HTTP with Python, is hardened up to the capstone.
12
chapters
64
lessons
33
practice exercises
13
projects
Lessons are arranged in a recommended order, but you can open any lesson.
Chapter 1
What Can Go Wrong
Chapter 2
Hashes, MACs, and Random Values
Chapter 3
Store Passwords Safely
Chapter 4
Sessions That Hold
Chapter 5
Signed Tokens and Secret Keys
Chapter 6
Who May Do What, and How Often
Chapter 7
Input That Becomes Code
- Accept Only What You Expectpractice
- Limit and Normalize Every Fieldpractice
- Data That Is Read as Instructions
- Keep a Line Break Out of a Headerpractice
- Redirect Only to Your Own Sitepractice
- Keep a File Name Inside Its Folderpractice
- Put Text in a Page, Not Markuppractice
- Project: Nothing Crosses Uncheckedcapstone
Chapter 8
Origins and Cross-Site Requests
Chapter 9
CORS
Chapter 10
HTTPS, Certificates, and Security Headers
Chapter 11
Capstone: Harden the Reading List
Chapter 12