AppSec

Practical Application Security for Developers

Build a strong foundation in modern application security and understand the principles behind securing applications.

Difficulty
Intermediate
Duration
~8 hours
Modules
5 modules
Lessons
16 lessons
Sign in to Start Course

What You'll Learn

  • Select cryptographic primitives based on the security properties they provide.
  • Explain how public-key cryptography, certificates, and TLS establish trust and protect communication.
  • Describe token formats and validation requirements used by APIs.
  • Compare OAuth 2.0, OpenID Connect, SSO, and passwordless authentication flows.
  • Distinguish user identity, service identity, authentication, and authorization.

Prerequisites

  • Familiarity with HTTP requests and responses.
  • Basic Java programming experience is helpful for the implementation examples.

Course Curriculum

Module 1: Cryptographic Primitives and Message Protection

2 lessons

  1. 1Hashing and Message Authentication
  2. 2Symmetric Encryption with AES

Module 2: Public-Key Trust and Secure Transport

3 lessons

  1. 1Public-Key Cryptography and Signatures
  2. 2Certificates and Trust Chains
  3. 3TLS and Secure Communication

Module 3: Token Foundations and Validation

4 lessons

  1. 1JOSE, Algorithms, and Key Distribution
  2. 2JWS and JWT Signing
  3. 3Validating Signed Tokens for APIs
  4. 4Token Encryption with JWE

Module 4: User Authentication: SSO to Passwordless

4 lessons

  1. 1OAuth, OIDC, and PKCE
  2. 2OIDC Tokens and Identity
  3. 3Magic Links and OTP
  4. 4Passkeys, WebAuthn, and Recovery

Module 5: Service Identity and Authorization

3 lessons

  1. 1Service Identity and Trust Boundaries
  2. 2Authenticating Service Calls
  3. 3Authorization for Service Call Chains