Labs, Capstone Projects, and Assessment

Complete these labs only in a local or explicitly authorized environment.

Lab 1: Secure registration and login

Password hashing with a maintained library Rate limiting and abuse monitoring

Generic authentication failure messages where appropriate Secure session creation and rotation Logout and session revocation

Password reset with short-lived single-use tokens Security regression tests

Deliverables: design notes, test cases, and a short threat model.

Complete every lab on your own machine or in an environment you are explicitly authorized to test. Use test accounts and fake data only — never real credentials, real personal data, or production systems.

Building blocks from this course The scrypt hashing example (Module 6), the single-use reset token (Module 6), the token-bucket limiter (Module 10) and the hardened cookie (Module 9) are the parts this lab combines. A minimal flow to aim for:

Text equivalent: the API asks the rate limiter first, loads the stored hash, verifies it with a constant-time comparison, returns the same failure message whether the account exists or not, and on success issues a fresh session cookie with secure attributes.

sequenceDiagram
  actor U as User
  participant API as Auth API
  participant RL as Rate limiter
  participant DB as User store
  U->>API: POST /login (email, password)
  API->>RL: allow(email, client)?
  RL-->>API: yes
  API->>DB: load password hash for email
  DB-->>API: hash (or none)
  API->>API: verify hash (constant time), same message for unknown email or wrong password
  API-->>U: Set-Cookie session (Secure, HttpOnly, SameSite) and rotate session ID

Lab 2: Secure course enrollment API

Request schema validation Rate limiting and pagination bounds Safe error responses Audit events without secrets

Acceptance tests: one student cannot view or modify another student's private progress; duplicate enrollment does not duplicate state; invalid transitions are rejected.

Lab 3: Secure file upload

Size and count limits Server-generated storage names Private storage outside executable web root

Safe parser/scan integration as appropriate Authorized download handler Resource and timeout limits

Acceptance tests: oversized, malformed, unauthorized, and path-manipulation inputs are safely rejected.

Lab 4: Security CI pipeline

Unit/integration tests Container/IaC scan where relevant Release approval and artifact verification

Deliverables: pipeline configuration, finding triage policy, and evidence of a controlled test run.

Lab 5: Incident response tabletop

Scenario: a production API key is found in a public repository.

Scope and access-log review Rotation and redeployment Communications and escalation

Capstone: Secure a learning platform

Build or assess a small learning application with users, courses, enrollments, progress, uploads, and administrator functions.

Required capstone artifacts Architecture and data-flow diagram.

Asset inventory and threat model.

Testable security requirements.

Authentication and recovery design.

Role/tenant authorization matrix.

Safe database and file-handling implementation.

Secrets and cryptography design.

Security tests and regression suite.

Dependency inventory/SBOM and remediation report.

CI security checks.

Logging, privacy, retention, and incident-response plan.

Deployment hardening and rollback plan.

Final risk register with residual risks and owners.

Suggested grading rubric Threat model and requirements Authentication and authorization Input, data, file, and API safety Cryptography and secrets management Testing and regression quality

Dependency, CI/CD, and deployment security Privacy, logging, resilience, and response Documentation and clarity

Explain the difference between authentication and authorization.

Why are parameterized queries safer than string concatenation?

Why is a random resource ID not a replacement for access control?

What are the differences among hashing, encryption, and digital signatures?

Why must AES-GCM nonces not be reused with the same key?

Why is a client-side role check insufficient?

What protections reduce SSRF risk beyond hostname validation?

Why are password-reset and account-recovery flows part of authentication security?

What is the purpose and limitation of an SBOM?

Why must confirmed vulnerabilities receive regression tests?

What should happen when an authorization service is unavailable?

What is the difference between a vulnerability, exploit, threat, and risk?

Why can a memory-safe language still contain serious security bugs?

How should a team respond to a leaked production secret?

What evidence would you require before releasing a high-risk feature?

Quiz

? Which belongs in Lab 2's acceptance tests? (select all that apply)
+ A student cannot read another student's private progress. :: Object-level authorization.
+ A duplicate enrollment request does not create a second enrollment. :: Idempotency.
+ An invalid state transition is rejected. :: Secure state machine.
- The API returns a stack trace on bad input. :: Errors must not expose internals.

? Why must authentication failures be generic ("Invalid email or password")?
+ Different messages reveal which accounts exist. :: Account enumeration helps targeted attacks.
- Generic messages are shorter. :: Not the reason.
- It is required by HTTP. :: HTTP does not specify this.
- It prevents SQL injection. :: Unrelated.

? In the capstone's grading rubric, which area has the largest weight?
- Cryptography and secrets management (10%) :: Smaller.
+ Authentication and authorization (20%) :: It carries the largest weight.
- Documentation and clarity (5%) :: Smallest.
- Testing and regression quality (15%) :: Large, but not the largest.