This lesson's interactive features are locked, please to keep using them

Web Security in Go

Welcome to "Learn Web Security in Go"! In this course, you'll learn how to defend web applications against real-world attacks, from injection vulnerabilities and cross-site scripting (XSS) to authentication bypasses and data leaks.

And you won't just read about them; you'll actively patch vulnerabilities in a real Go web application.

Learning Goals

Understand the most common web security vulnerabilities and how they work.
Learn to use security resources and techniques like STRIDE and the OWASP Top 10.
Gain hands-on experience fixing insecure code in a Go app.

This is a course on practical web application security, not a course on cryptography, network security, or operating system security. While those topics are important, they're outside the scope of this course.

Boot.dev CLI

You'll use the Boot.dev CLI to test work on your machine. You'll find each lesson's CLI commands in the test panel. The CLI has two modes:

bootdev run <id> runs checks without submitting.
bootdev run -s <id> submits your work and marks the lesson complete when it passes.

Starting with your next CLI lesson, you can omit <id> and use bootdev run or bootdev run -s.

Use run first unless the lesson says failed submissions are safe.

Assignment

Make sure your Boot.dev CLI setup is ready for the rest of the course.

Install the Boot.dev CLI if you haven't already.
Run bootdev --version and confirm it prints a version.
Run bootdev login and, if necessary, complete the browser login flow.
Copy the run command from the right pane and execute it in your terminal.

If that prints Security through obscurity ain't security, run the submit command.