Skip to content
Learning path

Security and Auth

JWT, OAuth 2.0, password hashing, CSPRNGs, packet-filtering firewalls — the building blocks of secure applications.

mixed5 courses50 lessons~13 hoursFree
Start pathor sign up to track progress

Course sequence

  1. 01

    Build a CSPRNG

    Not started

    Implement a cryptographic random number generator. Learn why Math.random() and rand() are insecure, how the OS gathers entropy, and implement HMAC-DRBG (NIST SP 800-90A) and Fortuna. The foundation underneath every TLS handshake, every AES IV, every session token.

    intermediate8 lessons~2h
  2. 02

    Build a Password Hasher

    Not started

    Implement secure password hashing: salts, PBKDF2-style iteration, bcrypt, argon2id, constant-time comparison, and rehash-on-login. Why SHA/MD5 for passwords is dangerous and what to use instead.

    intermediate8 lessons~2h
  3. 03

    Build a JWT Library

    Not started

    Implement JWT (JSON Web Tokens) end-to-end: base64url encoding, signing with HS256/RS256, claim validation, key rotation via kid, and defenses against the well-known JWT attacks (alg=none, key confusion, weak secrets). Used by every modern auth system.

    intermediate14 lessons~4h
  4. 04

    Build an OAuth 2.0 Server

    Not started

    Implement an OAuth 2.0 authorization server: authorization code flow, PKCE for public clients, access + refresh tokens with rotation, scopes, redirect URI validation, state-based CSRF defense, and token introspection. The auth protocol behind 'Login with Google/GitHub/Facebook' and every B2B SaaS.

    intermediate10 lessons~3h
  5. 05

    Build a Firewall (Packet Filter)

    Not started

    Build an iptables-style firewall: stateless and stateful packet filtering, connection tracking, NAT/SNAT/DNAT, port forwarding, rate limiting (token bucket), routing/forwarding, logging/monitoring, and the design behind Linux netfilter, BSD pf, and cloud security groups.

    advanced10 lessons~3h

Create a free account to track your progress across this path.

Security and Auth