Application security

The application decides who can act, on what, and under which conditions. Every request carries claims (a session, a token, an object ID, a URL to fetch) and the application has to decide which of them to believe. Most serious application vulnerabilities are a belief the code should not have held.

The course follows those decisions through a request: how identity is established, how authorization is enforced object by object and tenant by tenant, what happens when input is interpreted rather than merely stored, and how a team builds software where the secure path is the default one. It assumes you can read Python and know HTTP. It does not assume a security background.

The path#

flowchart LR
  R["<b>Request</b><br/><small>attacker-controlled</small>"] --> AN["<b>Authentication</b><br/><small>who is this?</small>"]
  AN --> AZ["<b>Authorization</b><br/><small>may they, on this object?</small>"]
  AZ --> IN["<b>Input handling</b><br/><small>parse, never interpret</small>"]
  IN --> E["<b>Effect</b><br/><small>data, files, outbound calls</small>"]
  class R warn
  class AN,AZ good
  class IN compute
  class E memory
classDef neutral fill:#faf9f5,stroke:#5f5e55,color:#141413,stroke-width:1.5px
classDef compute fill:#f9e2e9,stroke:#b3154f,color:#141413,stroke-width:1.5px
classDef memory fill:#f9e2e9,stroke:#b3154f,color:#141413,stroke-width:1.5px
classDef queue fill:#f9e2e9,stroke:#b3154f,color:#141413,stroke-width:1.5px
classDef io fill:#f9e2e9,stroke:#b3154f,color:#141413,stroke-width:1.5px
classDef default fill:#f9e2e9,stroke:#b3154f,color:#141413,stroke-width:1.5px
classDef warn fill:#f9e2e9,stroke:#b3154f,color:#141413,stroke-width:2px,stroke-dasharray:5 3
classDef good fill:#e2efd8,stroke:#2b6a24,color:#141413,stroke-width:2px

How each lesson works#

1. The idea in one minute. The claim, before the detail.
2. A picture of the attack or the defense.
3. How it really works, precisely, with standards and tools named.
4. Code: a small Python program using only the standard library. Vulnerable and fixed versions run against simulated applications inside the program.
5. Where it breaks. The limits of the control.
6. Remember this, Try it, and Check yourself.

What you need#

• Python 3.10 or newer and a terminal. Every program runs offline.