01 - Introduction to Authentication & Authorization
Explore the foundational mechanics, architectural patterns, stateful vs stateless trade-offs, and threat landscape of Authentication (AuthN) and Authorization (AuthZ).
02 - Modern Authentication Protocols & Session Security
Master modern authentication protocols including OAuth 2.0 PKCE, OpenID Connect (OIDC), FIDO2/WebAuthn, TOTP, and secure session management across multiple programming languages.
03 - JWT Security Masterclass & Cryptographic Exploitation
Master JSON Web Token (JWT) cryptographic mechanics, common implementation vulnerabilities (alg:none, Key Confusion, kid injection), JWKS rotation, and multi-language secure verification patterns.
04 - Authorization Models & Policy-as-Code Architecture
Master modern authorization paradigms (RBAC, ABAC, ReBAC), mitigate BOLA/BFLA vulnerabilities, and implement Policy-as-Code with Open Policy Agent (OPA) and Rego.
05 - Authentication & Authorization Security Tools & Automation
Master identity infrastructure tools (Keycloak, ORY Hydra, OAuth2-Proxy), Policy engines (OPA), CLI security scanners (jwt_tool, Hashcat), and Semgrep SAST rules for automated identity auditing.
06 - Hands-on Lab: Exploiting & Hardening JWT & Access Control
Self-contained hands-on lab demonstrating JWT signature bypass (alg:none), insecure cookie configuration, and Broken Object Level Authorization (BOLA/IDOR) with automated exploit scripts and production remediations.
07 - References, Standards, & CVE Case Studies
Authoritative references, RFC specifications, NIST SP 800-63B guidelines, OWASP standards, CVE case studies, and tool documentation for Authentication and Authorization.
Authentication & Authorization Masterclass
Master the foundational principles, attack vectors, and production-grade security architectures for identity management, modern authentication protocols, JWT security, and fine-grained authorization.