Web Application Security Course: Secure Your React and Django Apps (OWASP Top 10)

Explain how web apps get attacked at a high level and how this course is organised around the OWASP Top 10.

• What the OWASP Top 10 is: a community-maintained awareness list of the most critical web risks
• Trust boundaries: browser, server, database and third-party services
• Risk, impact and likelihood: how teams decide what to fix first
• Secure by design: least privilege, defence in depth and fail safe
• Our practice rule: only our own apps and deliberately vulnerable training apps, never anyone else's system

OWASP resourcesA training app run locally

Practice: Map the trust boundaries of a small Django and React app you built earlier

Build sign-up and login that holds up when passwords leak or users make mistakes.

• How to store passwords: salted, slow hashing and what Django does by default
• Password rules that help: length, breach checks, rate limiting and lockout design
• Two-step login and passkeys from a developer's view
• Safe password reset and email verification flows
• Common authentication failures: weak recovery, predictable tokens and missing rate limits

Django authArgon2 or the framework's password hashers

Practice: Add rate limiting, safe password reset and optional two-step login to a sample app

Choose and configure sessions or tokens so a logged-in user stays that user.

• Session cookies versus JWTs and the trade-offs of each
• Cookie flags: HttpOnly, Secure and SameSite
• Token expiry, refresh and logout that really ends a session
• Where a React app should keep tokens, and why local storage is a risky choice
• CORS explained properly: what it is and what it is not

Django sessionsDjango REST frameworkBrowser DevTools

Practice: Move a React and Django login to secure cookie-based sessions and check the flags in DevTools

Make sure every request is checked for who is asking and what they are allowed to do.

• Broken access control: why hiding a button is not security
• Object-level checks: users must only reach their own records
• Roles, permissions and Django REST framework permission classes
• Server-side checks for every action, and deny by default
• Insecure design: business logic flaws and how threat modelling catches them early

Django REST framework permissionspytest

Practice: Write tests that prove one user cannot read or edit another user's data, then fix any gap

Write code that keeps data separate from commands so user input cannot change what your app does.

• The core idea of injection: untrusted input mixed into a command or query
• Parameterised queries and the Django ORM, and the few places where raw SQL still needs care
• Cross-site scripting: output encoding, template auto-escaping and the risk of raw HTML in React
• Input validation, allow-lists and sanitising rich text with a trusted library
• Content Security Policy as a second layer of defence

Django ORMReactA training app to see the weaknesses safely

Practice: Review a deliberately vulnerable training app, explain each weak spot and write the fix

Protect actions that change data and handle files without opening new holes.

• Cross-site request forgery: why browsers send cookies automatically and how tokens and SameSite stop it
• CSRF protection in Django and in a React single-page app
• Server-side request forgery: why fetching a user-supplied URL needs care
• Safe file uploads: type and size checks, storage outside the web root and no trust in file names
• Rate limiting and basic abuse controls on APIs

Django CSRF middlewareDjango REST framework throttling

Practice: Add safe image upload and request limits to a sample app

Keep secrets out of code and keep your app's building blocks up to date and configured safely.

• Secrets handling: environment variables, secret managers and never committing keys to Git
• What to do when a secret leaks: rotate first, then clean up
• Vulnerable and outdated components: reading advisories and updating safely
• Software supply chain basics: lock files, trusted packages and reviewing new dependencies
• Security misconfiguration: debug mode, default settings, error messages and Django's deployment check

pip-auditnpm auditDependabotA secret scanner such as gitleaks

Practice: Audit the dependencies and settings of one of your projects and fix the top issues

Deploy an app so that traffic is encrypted and browsers get the right safety rules.

• HTTPS and certificates: what they protect and how hosting platforms set them up
• HSTS, secure cookies and redirecting HTTP to HTTPS
• Security headers: Content-Security-Policy, X-Content-Type-Options, frame protection and referrer policy
• Production settings in Django and safe React build and deployment practice
• Checking your headers with a free online scanner against your own site

Django security settingsRender, Railway, Vercel or NetlifyBrowser DevTools

Practice: Deploy a sample app with HTTPS and a strict set of headers and check the result

Record the right events so problems are noticed, without logging things you should not.

• Security logging and monitoring failures: what to log and what never to log
• Audit trails for logins, permission changes and sensitive actions
• Alerting on suspicious patterns at a simple level
• A small incident checklist: detect, contain, fix, recover and learn
• Privacy in logs: keeping personal data and secrets out

Python loggingDjango logging settings

Practice: Add an audit log for login and permission events and write a short incident checklist

Find problems early by thinking like a defender and letting automation help on every commit.

• Threat modelling with a simple framework such as STRIDE: assets, data flows and what could go wrong
• Turning findings into a prioritised backlog with owners
• Static analysis and linting for security: Bandit for Python and ESLint security rules
• Dependency and secret scanning in GitHub Actions
• Dynamic scanning of your own app in a local or staging copy with a tool such as OWASP ZAP, and how to triage results
• Writing a short security review report a team can act on

GitHub ActionsBanditOWASP ZAPSemgrep or similar

Practice: Add a security job to a GitHub Actions pipeline and fix what it reports