Application Security
Keeping untrusted input and unauthorised callers out.
3 subjects · 5 topics · 4 areas
Subjects covering this category
3 subjects- Subject · Beginner to Advanced
Designing HTTP APIs that clients can understand, call safely, and keep using as the API changes.
- HTTP for API Designers
- Designing the Contract
- Repeats, Retries and Long Jobs
- Subject · Intermediate to Advanced
Building a REST service with Spring Boot: wired to real data, validated, and fast enough to trust in production.
- Spring Boot Essentials
- Building REST APIs
- Data Access
- Subject · Beginner to Advanced
Turning a product's requirements into a first design for a web system, and knowing what each part is there for.
- Starting a Design
- The Parts of a System
- Moving Data Around
Authentication
3 topics- API Design
Authenticating API clients: API keys, sessions, bearer tokens, JWTs and mutual TLS, and which one suits each kind of caller.
Beginner to Advanced12 cards · 8 qnot started
- API Design
OAuth 2.0 and OpenID Connect: letting an application act for a user without their password, and learning who that user is.
Beginner to Advanced11 cards · 7 qnot started
- System Design
Scaling a web system up or out: bigger machines or more of them, what has to be stateless first, and what autoscaling cannot catch.
Beginner to Advanced9 cards · 5 qnot started
Authorization
1 topic- API Design
OAuth 2.0 and OpenID Connect: letting an application act for a user without their password, and learning who that user is.
Beginner to Advanced11 cards · 7 qnot started
OAuth
1 topic- API Design
OAuth 2.0 and OpenID Connect: letting an application act for a user without their password, and learning who that user is.
Beginner to Advanced11 cards · 7 qnot started
Input Validation
1 topic- Spring Boot
Validating request input with Bean Validation: constraint annotations, @Valid, and field-by-field error responses.
Intermediate to Advanced6 cards · 4 qnot started
In Application Security itself
1 topic- API Design
Protecting an API: the common API security risks, object-level checks, rate limits a client can act on, and what CORS does and does not do.
Beginner to Advanced10 cards · 8 qnot started