</>Code Temper

Beginner · Free · In your browser

Learn Web Security Foundations

Learn the security basics every web developer needs by finding and fixing real holes in small apps, in a sandbox where attacks cannot reach anyone. Stop cross-site scripting with safe DOM code, escaping and allow-list sanitizing; handle addresses and links safely; read and audit a Content Security Policy; set password rules that help and store passwords with slow, salted hashes; protect sessions with cookie attributes, CSRF tokens and careful token handling; understand CORS; prevent SQL injection; validate on the server; slow down brute force; check security headers; and finish with a full security review of a comment section.

20 lessons6 modules4.4 hours of practice4 challenges
Start the Web Security Foundations course →

No installation. Your code runs right in the browser. Finish JavaScript in the Browser first, or be comfortable with the DOM, events, forms and fetch. Every attack you try here stays inside a safe sandbox.

What you will be able to do

Course outline

Module 1

Untrusted input

Allow-lists, cross-site scripting, dangerous addresses, and input from the address bar.

  1. Every input is untrustedUntrusted input & allow-list validation · 10 min
  2. Cross-site scriptingStored XSS & safe rendering · 11 min
  3. Dangerous URLsnew URL() & allowed schemes · 10 min
  4. Input from the address barURLSearchParams, DOM-based XSS & building links · 11 min
Module 2

Safe HTML and pages

Escaping, allow-list sanitizing, links that leave your site, and Content Security Policy.

  1. Escape HTML when you must build itEscaping for text and attributes · 10 min
  2. Sanitize with an allow-listDOMParser, allow-lists & rebuilding the tree · 14 min
  3. Links that leave your sitetarget=_blank, rel=noopener noreferrer & origins · 10 min
  4. Content Security PolicyDirectives, sources & fallbacks · 13 min
Module 3

Passwords and sessions

Password rules, password hashing, session cookies, and a secure sign-up project.

  1. Password rules that helpLength, blocklists & current NIST guidance · 11 min
  2. Store passwords safelySalted, slow hashing & careful comparison · 14 min
  3. Cookies that protect sessionsSecure, HttpOnly, SameSite & the __Host- prefix · 12 min
  4. Project: a secure sign-up formFoundation project · validation, password rules, safe answers & careful requests · 22 min
Module 4

Requests you can trust

Cross-site request forgery, keeping tokens safe, and CORS.

  1. Cross-site request forgeryCSRF, SameSite & anti-CSRF tokens · 12 min
  2. Keep tokens out of reachTokens in memory, Authorization headers & 401 · 12 min
  3. Understand CORSSame-origin policy, CORS headers & credentials · 12 min
Module 5

Server-side defences

Injection and placeholders, validation on the server, and rate limits.

  1. Injection and parameterised queriesSQL injection & placeholders · 13 min
  2. Validate on the serverServer-side validation & mass assignment · 13 min
  3. Slow down brute forceRate limiting, sliding windows & 429 · 13 min
Module 6

Defence in depth and the capstone

Security headers, then a complete security review of a comment section.

  1. Security headersHSTS, CSP, nosniff, framing, referrers & version leaks · 12 min
  2. Capstone: secure a comment sectionCapstone · XSS, safe links, CSRF, validation & rate limits · 30 min

Ready for your first line?

Every lesson is short, hands-on, and checked automatically.

Start learning Web Security Foundations →