Authentication & Security
Secure your APIs with industry-standard patterns. JWT tokens, OAuth2, bcrypt password hashing, CORS, rate limiting, and OWASP Top 10 defences.
Why learn Authentication & Security?
Authentication and security mistakes are some of the most common, and most damaging, bugs a developer can ship. Auth & Security teaches the vocabulary of real attacks and the everyday defenses that stop them: OWASP risks, input validation, password hashing, JWTs, OAuth2, and production API hardening.
It is 5 modules and 29 lessons, built around practical FastAPI examples: security fundamentals, password security with slow salted hashing, JWT authentication with refresh tokens and role-based access, OAuth2 flows including how Sign in with Google actually works, and API security hardening covering rate limiting, HTTPS, CSRF defense, and security logging.
It ends with a capstone, Capstone: Securing a Real Endpoint, that composes a complete, secured API endpoint, layering every defense from earlier modules onto one route.
Who this course is for
- Backend developers who have never implemented authentication from scratch
- Anyone who has copy-pasted a login system without understanding why it works
- Developers preparing for the FastAPI & REST APIs or Backend Capstone tracks
- Engineers who want to actually understand OWASP risks instead of just naming them in an interview
What you'll build and practice
- Input validation and browser defenses that stop the most common OWASP-listed attacks
- Passwords stored with slow, salted one-way hashing, the only safe way to store them
- A JWT authentication system with refresh tokens and role-based access control
- An OAuth2 flow, including how Sign in with Google actually works under the hood
- The capstone: one FastAPI endpoint hardened with rate limiting, CSRF defense, and a full security checklist
What you'll learn
Authentication & Security is organized into 5 focused modules. By the end you'll be comfortable with:
- Security Fundamentals
- Password Security
- JWT Authentication
- OAuth2 in FastAPI
- API Security Hardening
Course curriculum
29 lessons across 5 modules. Lessons marked Free preview are readable without an account.
Module 1. Security Fundamentals
Understand the most common web vulnerabilities and how backend engineers prevent them.
- 9mOWASP Top 10 OverviewFree preview
Meet the ten most common ways web apps get broken into — the shared vocabulary every backend engineer is expected to know.
- 10mInput Validation and SanitizationFree preview
Treat every byte from the client as hostile until proven safe — validate at the boundary, sanitize before output.
- 9mSecurity Headers
A handful of HTTP response headers turn the browser itself into your bodyguard — against clickjacking, MIME sniffing, and protocol downgrades.
- 9mCORS Explained
Why your React app can't call your API — and what CORS actually is (hint: it loosens a browser rule, it isn't access control).
- 8mSecrets Management
API keys, DB passwords, signing keys — where they must live (environment, secret managers) and what to do the instant one leaks.
- 8mPractice: Security Fundamentals
No new concepts — just reps. Diagnose real-world scenarios using everything from Module 1.
Module 2. Password Security
Hash passwords correctly with bcrypt and understand why plaintext or weak hashing is catastrophic.
- 8mWhy Hash Passwords?
Why a plaintext password column is a catastrophe waiting to happen — and what a one-way hash actually buys you.
- 10mbcrypt and Salting
The two properties that make bcrypt the right password shredder: a unique salt per password and a tunable cost that keeps it slow.
- 11mpasslib and FastAPI Integration
Wire bcrypt into real register and login endpoints — and close the timing leak that quietly reveals which emails have accounts.
- 9mPassword Policies and Account Lockout
Set sensible strength rules (length beats symbols) and stop online guessing cold with lockout and rate limits.
- 8mPractice: Password Security
No new concepts — just reps. Diagnose password-storage and login-defence scenarios from across Module 2.
Module 3. JWT Authentication
Implement stateless authentication with JSON Web Tokens — the industry standard for API security.
- 10mWhat Are JWTs?
The tamper-evident wristband model: what a JWT contains, why it can't be forged, and why anyone can still read it.
- 11mCreating and Verifying JWTs in Python
Issue a signed token at login and verify it on every protected request with a clean FastAPI dependency.
- 10mRefresh Tokens
Keep users logged in for weeks without long-lived access tokens — and get real logout back with a revocable refresh token.
- 9mJWT Security Best Practices
The pitfalls that turn a working JWT setup into a vulnerable one — starting with the infamous `alg: none` forgery.
- 10mRole-Based Access Control
Gate endpoints by role with a reusable dependency — and know when a JWT claim is good enough vs when to hit the DB.
- 8mPractice: JWT Authentication
Reps across the whole JWT module — structure, verification, refresh tokens, pitfalls, and roles.
Module 4. OAuth2 in FastAPI
Implement OAuth2 password flow and understand social login concepts (Google, GitHub).
- 10mOAuth2 Flow Overview
OAuth2 is a valet key, not a house key — the four grant types and which one 'Sign in with Google' actually uses.
- 11mFastAPI OAuth2 Password Implementation
Wire up the OAuth2 Password flow with FastAPI's built-in helpers — the standard shape for first-party login.
- 10mSocial Login Concepts
How 'Sign in with Google/GitHub' really works — and the golden rule: turn their identity into YOUR token.
- 9mScopes and Fine-Grained Permissions
Scopes are hotel keycards — each opens only certain doors. Grant the fewest a client needs (least privilege).
- 8mPractice: OAuth2
Reps across the OAuth2 module — flows, the Password flow, social login's golden rule, and least-privilege scopes.
Module 5. API Security Hardening
Harden your API against CORS misconfiguration, rate limiting abuse, HTTPS enforcement, and data exposure.
- 10mRate Limiting for Security
The turnstile that starves brute-force and abuse — tighter on sensitive routes, keyed by user where you can.
- 8mHTTPS and TLS Enforcement
Encrypt the pipe so credentials can't be sniffed — and know exactly what TLS does and doesn't protect.
- 8mData Exposure Minimisation
Return only what the caller needs — separate response models for public, private, and admin views.
- 9mCSRF Protection
When your auth lives in a cookie, another site can make the user's browser act for them. Meet CSRF — and why token auth mostly sidesteps it.
- 8mSecurity Logging and Monitoring
You can't respond to what you can't see. Log the security events that matter — and never the secrets.
- 8mBackend Security Checklist
The pre-ship review that ties every module together — one place to catch what you missed.
- 12mCapstone: Securing a Real Endpoint
One realistic secured API, built layer by layer — every module of this course visible in a single flow.
Frequently asked questions
- Does this course assume I already know FastAPI?
- Basic comfort with FastAPI helps since the examples are built in it, but the security concepts themselves, hashing, JWTs, OAuth2, and OWASP risks, are taught from first principles and apply to any backend framework.
- Why can't I just store passwords in a database column, encrypted?
- Module 2 answers this directly: encryption can be reversed with the right key, which makes a stolen database catastrophic. Slow, salted one-way hashing (like bcrypt) cannot be reversed at all, so even a full breach does not hand over usable passwords.
- Does the course explain OAuth2, or just cookie-based login?
- Both, in separate modules. Module 3 covers JWT-based stateless authentication with refresh tokens. Module 4 is a full treatment of OAuth2: the grant types, FastAPI's password flow, and delegated login through providers like Google.
- Is this course only about web APIs, or does it cover browser-side security too?
- Module 1 opens with browser-side defenses and input validation before the API-specific modules begin, and Module 5 covers CSRF defense specifically, which is a browser-and-server problem together, not a server-only one.
- What does the capstone endpoint actually secure against?
- It layers validation to reject malformed input, bcrypt hashing so a breach does not leak usable passwords, a response model that cannot accidentally return internal fields, and defenses against timing attacks that would otherwise let an attacker enumerate valid accounts.
Ready to start Authentication & Security?
Create a free account to track progress, earn XP, and get instant help from the AI tutor as you code.
Create your free account