Study application security foundations

1. 01

   Concepts & system design

   60 min· read · map the mechanismtimer

   R02 — OWASP ASVS access control

   R03 — OWASP API1: BOLA

   R40 — OWASP WSTG API & auth testing

   Read the assigned sections; map the mechanism, threat model and trade-offs.

2. 02

   Project implementation

   120 min· build · integrate · debugtimer

   Study IDOR/BOLA, input validation, SQL injection parameterization, CORS vs. CSRF, and safe error contracts. Wrap the chat loop in a minimal FastAPI endpoint.

   Build, integrate, debug and improve the increment in the active project.

3. 03

   Security lab

   60 min· attack your own systemtimer

   Prove User A cannot read or modify User B's conversation by changing conversation_id in the request (use test principal headers).

   Test the abuse case, failure path, authorization bypass or resource limit.

4. 04

   Verification & evidence

   30 min· test · record evidencetimer

   Endpoint threat model and automated IDOR/BOLA access-control test passing.

   Add or run regression tests; record the 9-point evidence record.

5. 05

   Deliberate practice & Socratic review

   30 min· explain aloud · update gapstimer

   Answer the 8 Socratic questions without notes: What? Why? How? What if? Why not? How can I prove it? Where can it break? What have I learned?

   Re-explain the hardest concept aloud, inspect one edge case, update the gap log.

6. total5 h

• R02OWASP ASVS↗ owasp.org

  Access-control, validation, authentication, file-handling, and logging requirements.

• R03OWASP API Security Top 10↗ owasp.org

  BOLA (API1), Broken Auth (API2), Unrestricted Resource Consumption (API4), SSRF (API7), Misconfiguration (API8).

• R40OWASP WSTG↗ owasp.org

  Web Security Testing Guide: hands-on test cases for authentication, authorization, session, input, and API security.

Read only the named sections needed for today's task. Reading sits inside the 60-minute concepts block; it is not extra time.

• docsOWASP Foundation
  OWASP API Security Top 10

  API1 BOLA, API2 broken authentication, API4 resource consumption, API7 SSRF, and API8 misconfiguration are the checklist you map your new FastAPI endpoint against, with attacker/victim framing per item.

  R03S0moved 2026-11-11
• videoPwnFunction · 8:14
  Insecure Direct Object Reference (IDOR) Explained

  Shows the request-id swap that turns your own record into someone else's, which is the exact test you run against a conversation endpoint that trusts a client-supplied id.

  R03checked 2026-11-11
• videoTejas Kumar · 8:11
  CSRF and CORS Explained

  Separates the two confusable browser controls: CORS relaxes same-origin reads, CSRF abuses ambient credentials, which is why a CORS preflight is not a CSRF defence.

  S0checked 2026-11-11
• articlePortSwigger Web Security Academy
  Insecure direct object references (IDOR)

  Explains where IDOR sits inside broken access control and why parameterized ownership checks on the server, not hidden ids, are the actual fix.

  R03R40checked 2026-11-11
• labPortSwigger Web Security Academy
  Lab: Insecure direct object references

  A free lab where you retrieve another user's chat transcript by changing an id in the request, mirroring the BOLA test you then write against your own endpoint.

  R40R02checked 2026-11-11

A lab is complete only when it produces evidence. Installing PyRIT, Garak, Presidio or TransformerLens is not completion. Saved on this device only.