Security Fundamentals roadmap

What you will learn

1. 1. Security Foundations

   The two most exploited web weaknesses: injection and broken access control.

   • SQL, Command Injection & Path Traversal — Security · SQL, Command Injection & Path Traversal
   • Authorization, RBAC & ABAC — Security · Authorization, RBAC & ABAC

2. 2. Passwords, OAuth & OIDC

   Store passwords safely, add MFA, and delegate identity with OAuth, OpenID Connect and JWT.

   • Passwords, Hashing & MFA — Security · Passwords, Hashing & MFA
   • OAuth, OIDC & JWT — Security · OAuth, OIDC & JWT

3. 3. Authentication Fundamentals

   How web apps keep users signed in with sessions, cookies and tokens, and how XSS and CSRF attacks abuse them.

   • Sessions, Cookies, OAuth & JWT — Backend Engineering · Sessions, Cookies, OAuth & JWT
   • XSS & CSRF — Security · XSS & CSRF

4. 4. API & Infrastructure Security

   Defend services against SSRF, configure CORS, security headers and TLS, and manage secrets with least privilege.

   • SSRF — Security · SSRF
   • CORS, Security Headers & TLS — Security · CORS, Security Headers & TLS
   • Secrets & Least Privilege — Security · Secrets & Least Privilege

5. 5. Threat Modeling & Secure Coding

   Use the OWASP Top 10 and threat modeling to find risks early, and write code that resists them.

   • OWASP Top 10 & Threat Modeling — Security · OWASP Top 10 & Threat Modeling
   • Secure Coding — Security · Secure Coding