Web Security with Python

Take a working web service and make it hard to abuse. You will store passwords so a leak does not reveal them, keep sessions and signed tokens that cannot be forged, validate what a request may ask for, stop cross-site requests, answer CORS correctly because you know what a browser checks, and keep secret keys out of your source. You run every attack against your own server and prove every fix with a test.
You need HTTP with Python first: a JSON API written as a handle(request, state) function, cookies and a server-side session, Basic and bearer authentication, and tests that call the handler directly. Python Fundamentals II helps but is not required: you read a few classes and never write one.
Every attack targets your own code, on the loopback address or in memory; the sandbox has no internet and no browser. The browser rules behind CSRF and CORS are a small model that you write yourself. One project, the reading list from HTTP with Python, is hardened up to the capstone.