Ryo T.
Sample Code review checklist is great
The checklist from the last lesson is now part of our pull request template.
OWASP Top 10 for developers: prevent the most common flaws
Understand each OWASP Top 10 risk from a developer's point of view and learn the coding patterns, framework features and tests that prevent it
Created by Jonas Lindqvist
- Updated September 2026
- English
- Intermediate
What you will learn
- Explain each OWASP Top 10 category in terms of developer mistakes
- Enforce access control on the server with deny by default patterns
- Prevent injection with parameterised queries and contextual output encoding
- Store passwords and manage sessions using current recommendations
- Harden configuration and dependencies in a repeatable way
- Add tests and static analysis rules that stop regressions
Course content
Thinking about risk as a developer
Authentication and sessions
- Video: Password storage with modern hashing 10 min
- Video: Sessions and cookies done right 10 min
- Article: MFA, passkeys and account recovery 10 min
- Video: Rate limiting and abuse protection 9 min
Data protection and cryptography
- Video: Choosing cryptography you do not invent 10 min
- Article: TLS everywhere and HSTS 8 min
- Video: Secrets and key management 9 min
- Video: Protecting personal data in logs and backups 8 min
Design and supply chain
- Article: Insecure design and threat modelling 11 min
- Video: Business logic flaws 9 min
- Video: Dependencies and software supply chain 10 min
- Article: Integrity of builds and data 9 min
Requests to other systems
- Video: Server side request forgery prevention 10 min
- Video: File uploads handled safely 9 min
- Article: Security headers and Content Security Policy 10 min
Detection and keeping it fixed
- Video: Logging and alerting for security events 10 min
- Video: Security tests in the test suite 10 min
- Article: Static analysis and dependency scanning in CI 9 min
- Video: A secure coding checklist for code review 8 min
- Quiz: Final check 6 min
Requirements
- Experience building web applications in at least one language
- Basic understanding of HTTP requests, cookies and databases
Description
The OWASP Top 10 is the most widely used summary of web application security risks. It is often presented as a list of scary names. This course presents it as what it really is for developers: a list of mistakes with well known, practical ways to prevent them.
How we approach each risk
For every category we follow the same path: how the mistake appears in ordinary code, the secure pattern that replaces it, the framework features that do the work for you, and a test or rule that keeps the problem from coming back. Examples are in Python with Django and FastAPI, JavaScript with Node.js and Express, and Java with Spring, because those are what most teams write.
- Access control enforced on the server, for every request
- Parameterised queries and safe output encoding
- Secure defaults and configuration that cannot drift
- Authentication, sessions and password storage done properly
- Cryptography choices you do not have to invent
- Dependency and supply chain hygiene
- Logging, alerting and error handling that help defenders
Versions
The course covers the 2025 edition of the OWASP Top 10 and notes where categories moved or merged compared with the 2021 list, so you can read older reports and tools that still use the previous numbering. The focus throughout is prevention in your own code base, not attacking other people's systems.
Who this course is for
- Web and API developers who want a practical security foundation
- Tech leads setting secure coding standards for a team
- QA engineers adding security checks to test suites
Instructor
Jonas Lindqvist
Application security engineer helping developers write, review and test secure code
- 4.3 instructor rating
- 28 reviews
- 7,320 students
- 4 courses
- Sample
I sit between development and security teams, reviewing code, tuning scanners and teaching developers how common vulnerabilities actually appear in real code bases.
My courses are written for developers first. We read vulnerable code, exploit it in a safe lab, fix it and add a test or rule so it stays fixed. Examples use Python, JavaScript and Java because that is what most teams I meet write.
I focus on the OWASP Top 10, API security, authentication, and tooling such as Semgrep, CodeQL and secret scanners. My aim is that security becomes part of your normal review, not a separate step at the end.
Student reviews
Laura V.
Sample Finally practical OWASP training
Every category ends with a pattern and a test. Our team added access control negative tests the next sprint.
Nnamdi O.
Sample Clear on access control
Scoping queries to the user's account instead of checking afterwards removed a whole class of bugs in our API.
Clara M.
Sample Helpful 2025 changes overview
Good explanation of how the 2025 edition differs from 2021, which helped me read older reports.
Petra H.
Sample Good multi language examples
Python, Node and Java examples made it easy to share with the whole team. Some Java parts were brief.
Arash N.
Sample Misconfiguration lesson hit home
We had actuator endpoints exposed in staging. Fixed after this course, plus a header test in CI.
Selma B.
Sample Solid, a bit long
Content is accurate and useful. Some lessons could be shorter for experienced developers.
Keep exploring
All Secure Development courses
More in Secure Development
$54.99
Enroll now