Study HTTP request/response lifecycle

1. 01

   Concepts & system design

   60 min· read · map the mechanismtimer

   R01 — FastAPI path operations & HTTP lifecycle

   R03 — OWASP API Security Top 10: broken authorization

   Read the assigned sections; map the mechanism, threat model and trade-offs.

2. 02

   Project implementation

   120 min· build · integrate · debugtimer

   Study HTTP request/response lifecycle, JSON, status codes, cookies, sessions, and API boundaries. Build a minimal terminal chat loop connected to Ollama.

   Build, integrate, debug and improve the increment in the active project.

3. 03

   Security lab

   60 min· attack your own systemtimer

   Distinguish authentication (who you are) from authorization (what you may access); write 3 concrete abuse cases for chat endpoint access.

   Test the abuse case, failure path, authorization bypass or resource limit.

4. 04

   Verification & evidence

   30 min· test · record evidencetimer

   Request-flow architectural sketch and documented abuse-case list.

   Add or run regression tests; record the 9-point evidence record.

5. 05

   Deliberate practice & Socratic review

   30 min· explain aloud · update gapstimer

   Answer the 8 Socratic questions without notes: What? Why? How? What if? Why not? How can I prove it? Where can it break? What have I learned?

   Re-explain the hardest concept aloud, inspect one edge case, update the gap log.

6. total5 h

• R01Python, FastAPI & Pydantic↗ fastapi.tiangolo.com

  FastAPI tutorial, request bodies, dependencies, async, and Pydantic model validation.

• R03OWASP API Security Top 10↗ owasp.org

  BOLA (API1), Broken Auth (API2), Unrestricted Resource Consumption (API4), SSRF (API7), Misconfiguration (API8).

Read only the named sections needed for today's task. Reading sits inside the 60-minute concepts block; it is not extra time.

• docsFastAPI
  Tutorial - User Guide - FastAPI

  Request bodies, path/query parameters, dependencies, and async handlers are the exact primitives you need to wrap a terminal chat loop in an HTTP endpoint without hand-parsing JSON.

  R01S0checked 2026-11-11
• videoTraversy Media · 38:30
  HTTP Crash Course & Exploration

  Walks methods, headers, status codes, and the full request/response cycle in the browser devtools, which is the mental model behind API boundaries and error contracts.

  S0checked 2026-11-11
• videofreeCodeCamp.org · 1:04:33
  FastAPI Course for Beginners

  Builds a working API with Pydantic request bodies and validation errors, so the chat loop you write can be exposed with typed inputs and automatic 422 responses.

  R01checked 2026-11-11
• articleMDN Web Docs
  Using HTTP cookies - HTTP | MDN

  Explains Set-Cookie attributes, session identifiers, and SameSite/HttpOnly scoping, which is the mechanism that separates a stateless request from an authenticated session.

  S0checked 2026-11-11
• repoGitHub
  OWASP/crAPI

  Intentionally vulnerable microservice API with BOLA and broken-auth endpoints you can probe with curl to see object-level authorization failures on a real API surface.

  R03S0checked 2026-11-11

A lab is complete only when it produces evidence. Installing PyRIT, Garak, Presidio or TransformerLens is not completion. Saved on this device only.