Secure coding principles: Python and JavaScript
You find input validation, output encoding, authentication and authorisation mistakes in real code and write their safe versions in Python and JavaScript.
Level 201 · 19 lessons · 15 practice labs
Lessons
Input
- Trusting no input: where input comes from
- Validating with an allowlist
- Schema validation with pydantic and zod
- Joining file paths safely
- Short task: validate every input of an API endpoint
Output and injection
- Context-aware output encoding: HTML, attribute, URL
- Parameterised queries and ORM pitfalls
- Getting the job done without a shell command
- Avoiding unsafe deserialisation: pickle and yaml
- Short task: fix three injection flaws and prove it with tests
Identity and access
- Storing passwords: argon2 and bcrypt
- Session handling: cookie flags and lifetime
- Authorisation on every request: object-level access
- Setting up CSRF and CORS correctly
- Short task: fix the endpoint that shows someone else’s invoice
Errors, logs and cryptography
- Error handling: little to the user, enough to the log
- Safe logging: filtering out personal data and secrets
- Not rolling your own crypto: proven libraries
- Capstone: find and fix the security flaws of a small notes app
Practice labs
- List every input an API endpoint takes: Write the inputs coming from path, query, body, headers and cookies and the expected type of each.
- Validate input with an allowlist and a schema: Add a pydantic or zod schema to the endpoint and show with tests that unexpected fields and out-of-range values return 400.
- Make file path joining safe: Show with a test that user input can escape the allowed directory in a download endpoint, resolve the path and add a boundary check, and prove the test passes.
- Encode output for its context: Fix a template that prints the username unescaped in the HTML body and confirm special characters render as text.
- Make a raw ORM query and a shell call safe: Parameterise a query built by string formatting and call the shell-run command with an argument list instead.
- Fix three injection flaws and prove it with tests: Fix the SQL, command and unsafe deserialisation flaws, replace pickle and yaml.load with safe equivalents and write a regression test for each.
- Check and fix the session cookie’s flags: Add the Secure, HttpOnly and SameSite flags and verify them in the response header.
- Move password storage to argon2: Change passwords stored as unsalted hashes to argon2 and show existing users are upgraded at first login.
- Fix the endpoint that shows someone else’s invoice: Add an object-level authorisation check, correct the CSRF and CORS settings and prove it with tests using two users.
- Simplify the error message returned to users: Send the stack trace to the log instead of the response and return only an error ID to the user.
- Filter personal data and secrets out of logs: Add a filter to the log formatter that masks passwords, tokens and card numbers and verify it with a test.
- Replace home-made encryption with a proven library: Swap a hand-written cipher with a fixed key for an authenticated encryption library call, migrate the old data and show tampered data is rejected.
- Mark the security-sensitive spots in the notes app’s code: List the functions that take input, run queries and touch files.
- Report the flaws in the notes app with evidence: Find five flaws in the app in your own lab and write the file, line and impact of each.
- Find and fix the security flaws of the notes app: Fix the input validation, authorisation, session and logging flaws, prove each fix with a test and write the change summary.
About this course
You find input validation, output encoding, authentication and authorisation mistakes in real code and write their safe versions in Python and JavaScript.
What you will learn
- Input
- Output and injection
- Identity and access
- Errors, logs and cryptography
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.