Free course

Web Authentication Course

Secure a web API with password authentication, server-side sessions, authorization, CSRF defenses, OAuth and OIDC, passkeys, recovery, MFA, and operational controls.

5 modules · 25 lessons · No signup

Prerequisites: Web Forms, HTTP, Web APIs and SQL

~~~

Your progress

of lessons completed.

Course completed.

What you'll learn

Design, implement, test, and operate a vendor-neutral authentication system that protects each user’s Books API resources and supports modern login and recovery paths.

Take this course offline

Subscribe to my newsletter to get every free book and course in PDF and EPUB format.

Get the downloads

Course contents

  1. Authentication foundations

    Separate identity and authorization, threat-model the system, and create secure sessions.

    1. ✓ Separate identity, authentication, and authorization
    2. ✓ Threat-model the login system
    3. ✓ Choose server-side sessions
    4. ✓ Set a secure session cookie
    5. ✓ Check your understanding: authentication foundations

  2. Password authentication

    Design signup, hash passwords safely, implement login, and resist automated attacks.

    1. ✓ Design safe signup
    2. ✓ Hash passwords with a trusted library
    3. ✓ Implement login with generic errors
    4. ✓ Defend against automated login
    5. ✓ Check your understanding: password authentication

  3. Sessions and authorization

    Authenticate requests, enforce ownership, prevent CSRF, and manage session trust.

    1. ✓ Authenticate every request
    2. ✓ Authorize resource ownership
    3. ✓ Protect cookie requests from CSRF
    4. ✓ Rotate, revoke, and step up sessions
    5. ✓ Check your understanding: sessions and authorization

  4. Federated login and passkeys

    Use OIDC, authorization code with PKCE, safe account linking, and WebAuthn.

    1. ✓ Separate OAuth from login
    2. ✓ Use authorization code with PKCE
    3. ✓ Link federated identities safely
    4. ✓ Add passkeys with WebAuthn
    5. ✓ Check your understanding: federated login and passkeys

  5. Recovery and operations

    Verify email, reset passwords, design MFA recovery, monitor, test, and respond.

    1. ✓ Verify email ownership
    2. ✓ Build password recovery
    3. ✓ Design MFA and recovery
    4. ✓ Operate and test authentication
    5. ✓ Check your understanding: recovery and operations