09 - Security Deep Dive
This track is about defending a backend against the attacks that break otherwise-correct systems. Track 03 taught you to prove who a caller is and decide what they may do; this track assumes that auth is solid and asks the harder question — how does an attacker get in anyway? They attack the code around the auth: the query that trusts a URL parameter, the template that echoes a comment unescaped, the endpoint that fetches an attacker's URL, the login with no rate limit, the secret hardcoded in source. You'll work through the OWASP Top 10 as a way of thinking (not a checklist), exploit and then fix each major attack class yourself, implement real rate limiting, manage secrets properly, and apply the browser-enforced hardening every app should ship with — all secure-by-design, all in Python/FastAPI.
How this track works
- It assumes you finished 03-authentication-and-authorization:
you're comfortable with sessions, JWTs (and key ids), API keys, MFA, RBAC/the
centralized permission layer, constant-time comparison, and hardened cookies
(
HttpOnly/Secure/SameSite). This track builds directly on that — it does not re-teach auth; it defends everything around it, and reaches back to specific track-03 modules by name. - Every module builds only on concepts from earlier modules in this track plus the track-03 knowledge you already have — no forward references. Module 00 installs the trust-boundary lens that every later module applies.
- Each module README has the same shape: why it matters, concepts, a command
reference with real Python/FastAPI (parameterized queries, escaping/CSP
middleware, SSRF-safe fetchers, Redis rate limiters,
SecretStrconfig, security-header middleware), progressive hands-on exercises (do them — including a "diagnose and fix" scenario each), an independent challenge with no code, common mistakes, and a checkpoint quiz. Two cumulative reviews (after modules 02 and 05) mix questions from everything so far, closed-book. - The exercises grow one deliberately-attackable FastAPI project (
sec-track) — ideally theauth-trackyou built in track 03 — so you're exploiting and hardening a real system with real auth, not toy snippets. The capstone hardens it end to end. Use Python 3.11+ and Redis in Docker, same as the rest of the curriculum. - Libraries used:
fastapi,sqlalchemy(parameterized queries/ORM),nh3(HTML sanitization),httpx+ipaddress(SSRF-safe fetching),redis+slowapi(rate limiting),pydantic-settings(SecretStrconfig),pip-audit/bandit/gitleaks(dependency + code + secret scanning).
Modules
| # | Module | What you'll be able to do | Time |
|---|---|---|---|
| 00 | The OWASP Top 10 as a way of thinking | Use trust boundaries and the attacker mindset to reason about the Top 10 as a model, not a checklist; threat-model your own app | 45-60 min |
| 01 | Injection attacks | Exploit and then kill SQL, command, and NoSQL injection with parameterized queries, argv lists, typed input, and identifier allowlists | 75-90 min |
| 02 | XSS and CSRF | Defend against stored/reflected/DOM XSS (escaping, sanitization, CSP) and CSRF (SameSite, synchronizer tokens), and reason about their tradeoff |
75-100 min |
| 03 | SSRF and deserialization attacks | Stop server-side request forgery (allowlist/resolve-validate) and insecure deserialization (never pickle untrusted data; JSON/safe_load) |
75-90 min |
| 04 | Rate limiting and abuse prevention | Implement token-bucket and sliding-window limiters on Redis — atomic, shared, correctly keyed — to stop brute force, stuffing, and scraping | 75-100 min |
| 05 | Secrets management | Keep secrets out of code, logs, and git history; use env/vault-backed config, rotate with zero downtime, and scope to least privilege | 60-90 min |
| 06 | Security headers and hardening | Ship HSTS/CSP/nosniff/X-Frame-Options/secure cookies via middleware, scan dependencies for CVEs, and run security-focused code review |
60-90 min |
| 07 | Capstone project | Take a deliberately vulnerable FastAPI app and harden it end to end against every attack class in the track — secure-by-design, defended, demonstrated | 4-6 hrs |
Start here → 00-owasp-top-10-overview/README.md
Back to the master index: ../README.md
Once you've completed this track, the next one is 10-distributed-systems-patterns — a shift from securing a single backend to coordinating systems of them: CAP- theorem tradeoffs, idempotency and distributed locking, and the saga/CQRS/event- sourcing patterns that keep many services correct together.