Flexible path3 sections

API Security & Auth

Authentication, authorization, tokens, tenant boundaries, and API protection.

A practical API security track covering login flows, JWT validation, refresh tokens, session revocation, external identity providers, roles and capabilities, resource ownership, tenant isolation, policy authorization, admin audit, stale claims, service-to-service auth, CORS, CSRF, rate limiting, overposting, safe errors, secrets, and browser-facing security controls.

Recommended start

Auth Foundations

Authentication boundaries, password login, JWT validation, refresh tokens, session revocation, password reset, and external identity providers.

9 drillsSection 1 of 3

Open section Browse all drills

Learning path

3 active sections / 24 drills

1Auth FoundationsRecommended startAuthentication boundaries, password login, JWT validation, refresh tokens, session revocation, password reset, and external identity providers.9 drillsSection 1Open section 2Authorization BoundariesRoles, permissions, capabilities, IDOR prevention, tenant authorization, policies, admin audit, stale claims, and service-to-service auth.7 drillsSection 2