Free to read ยท Three levels
Web Security: defensive boundaries and verification
A complete bilingual course on defensive web engineering, connecting HTTP, identity, browser policy, data interpretation, and verified recovery.
Start learningIn this course
Follow a fictional reading portal across browser, transport, application, and data trust boundaries. Basic lessons establish HTTP semantics, threat modeling, authentication, session design, resource authorization, and validation. Each defense is explained by the claim it supports and the assumptions it leaves to another layer.
Intermediate lessons cover output encoding, injection prevention, CSRF, CORS, uploads, and server-side retrieval. Advanced lessons connect security headers, secret lifecycle, logging, verification, supply-chain trust, and incident recovery. Every lesson includes developed explanations, benign contextual examples, cause-and-fix records, worked exercises, takeaways, and official primary sources.
Arabic lessons retain the English concepts, examples, errors, and worked reasoning with identical technical identifiers and code. Exercises use invented metadata, public classroom markers, local parsers, and in-memory policies. They never require a real application target, credential, scanner, database engine, configured service, or cloud account.
What you will learn
- Model web trust boundaries and versioned security requirements.
- Separate authentication, authorization, request authenticity, and browser sharing.
- Use safe data interpretation, bounded file and outbound capabilities, and reviewed response policy.
- Interpret tests, logs, dependency evidence, and recovery decisions without unsupported certainty.
Your learning path
Three levels
Basic: web trust and identity contracts
Understand protocol semantics, threat requirements, authentication, sessions, access scope, and input meaning.
- HTTP and web trust boundaries
- Threat modeling and verifiable web requirements
- Authentication, enrollment, and recovery
- Sessions, cookies, and browser state
- Authorization and tenant-safe resource scope
- Validation, parsing, and canonical forms
Intermediate: browser and data interpretation defenses
Keep text, query, request, origin, file, and outbound retrieval contracts explicit and verifiable.
- Output encoding and XSS prevention
- Injection prevention through data separation
- CSRF and request authenticity
- CORS, origins, and credentialed browser access
- Uploads and the complete file lifecycle
- SSRF and server-side outbound boundaries
Advanced: assurance, supply chain, and recovery
Connect browser policy, keys, diagnostics, testing, dependencies, and incident decisions to bounded evidence.
- Security headers and Content Security Policy
- Secrets, keys, and lifecycle boundaries
- Security logging and safe error handling
- Security verification and regression evidence
- Dependency and build-chain security
- Incident recovery and secure change
Who this is for
- Developers learning to design and review web features defensively.
- Learners who want a precise distinction between local evidence and a deployed security claim.
Before you start
- Basic familiarity with HTTP, HTML, and programming functions and data structures.
- Ability to read small Python, JavaScript, JSON, and header examples. Optional local validation uses already available standard tools; no external service or privileged access is required.