End-to-end web application capstone
You build a booking application yourself from design to launch, combining an API, a database, an accessible front end, authentication, caching and performance measurement in one project.
Level 501 · 15 lessons · 12 practice labs
Lessons
Design
- Requirements, user stories and acceptance criteria
- Architecture: client, API, database, proxy
- API contract and data model
- Short task: review your design against a checklist
Build
- Back end and database layer
- Login and authorisation
- An accessible front end
- Live notifications
- Unit, API and end-to-end tests
- Short task: add a waiting-list feature
Launch and operation
- Launching behind Nginx with HTTPS
- Caching layers
- Performance and accessibility audit
- Logging, metrics and error tracking
- Capstone: launch the application and write the handover report
Practice labs
- Write acceptance criteria for user stories: Write testable acceptance criteria for five user stories of a neighbourhood library's reservation app.
- Match the data model to the API contract: Compare the API contract's fields with the database schema and resolve missing and extra fields.
- Draw up a threat list for the architecture: Draw the client, API, database and proxy architecture and list likely threats and defences for each link.
- Add role-based access checks: Add a role check to the API so only staff can delete books in the library app.
- Add a live channel for return notices: Add an SSE channel that instantly notifies the waiting member when a reserved book is returned.
- Guard the reservation flow with end-to-end tests: Verify the member login, book reservation and notification flow end to end with API and browser tests.
- Put the capstone app behind a reverse proxy: Run the app behind an Nginx reverse proxy and serve static files straight from Nginx.
- Turn on HTTPS and security headers: Set up HTTPS with a local certificate authority, add HSTS, CSP and other security headers and verify them in the browser.
- Set up layered caching safely: Set separate cache rules for static files, the catalogue API and personal pages and prove personal data never gets cached.
- Add context to error logs: Log server errors with request ID, user role and version, then follow one error back to its source.
- Publish basic metrics: Add a metrics endpoint to the API that reports request count, error rate and latency percentiles.
- Report on a post-launch audit: Run a performance and accessibility audit on the live app and write the findings and priority fixes into a handover report.
About this course
You build a booking application yourself from design to launch, combining an API, a database, an accessible front end, authentication, caching and performance measurement in one project.
What you will learn
- Design
- Build
- Launch and operation
Prerequisites
You should be experienced in the topics of the same path up to level 401.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 501; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.