Phase 02 - Networking, Web, API, Identity, Authorization, and Cryptography
Duration: 8 weeks (Months 5-6)
Objective: trace and secure a request across network, protocol, identity, policy, application,
and key-management boundaries.
Deep guides: WARMUP.md follows a request from DNS to authorized data access; HITCHHIKERS-GUIDE.md provides the web/API attack lab, TLS/mTLS operations, authorization test patterns, and reporting standard.
Required Theory
- Ethernet, ARP, IPv4/IPv6, routing, TCP, UDP, DNS, NAT, proxies, load balancers, and segmentation.
- HTTP/1.1, HTTP/2, HTTP/3, WebSockets, gRPC, GraphQL, caching, and request smuggling concepts.
- TLS 1.2/1.3, PKI, certificate validation, revocation limits, mTLS, key rotation, KMS/HSM, envelope encryption, nonces, signatures, and password hashing.
- Sessions, cookies, CSRF, CORS, OAuth 2.0, PKCE, OIDC, SAML, SCIM, JWT/JWS/JWE, WebAuthn, service/workload identity, RBAC, ABAC, ReBAC, and policy decision/enforcement points.
- XSS, SQL/command injection, SSRF, path traversal, unsafe deserialization, file upload, broken object/function authorization, mass assignment, abuse, replay, and rate limits.
Labs
All vulnerable behavior is confined to purpose-built local services.
| Lab | Work | Security proof |
|---|---|---|
| 02.1 Packet journey | capture DNS, TCP, TLS, HTTP/2, and HTTP/3 local flows | annotated pcap and protocol state diagrams |
| 02.2 Vulnerable web app | seed and then fix XSS, CSRF, injection, traversal, upload, SSRF, and deserialization flaws | negative tests and remediation diff |
| 02.3 OIDC + PKCE | implement login, callback, state, nonce, token validation, refresh, logout | replay, redirect, issuer, audience, and expiry tests |
| 02.4 JWT failure lab | demonstrate algorithm/key confusion concepts using toy validators, then enforce policy | test matrix; no production-token tooling |
| 02.5 SAML SSO | local IdP/SP, metadata, signing, audience, recipient, replay cache | assertion validation tests |
| 02.6 SCIM lifecycle | provision, update, deactivate, reconcile, and audit users/groups | idempotency and deprovisioning tests |
| 02.7 mTLS services | local CA, workload certificates, rotation, identity mapping | unauthorized peer and expired cert tests |
| 02.8 TLS inspector | Go or Rust tool for chain, names, dates, algorithms, and policy | fixtures for valid and invalid chains |
| 02.9 Authorization suite | object, function, tenant, batch, GraphQL, gRPC, and WebSocket cases | deny-by-default policy matrix |
| 02.10 Secure upload | streaming limits, content handling, quarantine, random names, isolated processing | polyglot, traversal, oversized, and race tests |
| 02.11 Password recovery | single-use bounded tokens, session revocation, privacy-safe responses | enumeration and replay tests |
| 02.12 Secret rotation | versioned secret, dual-read transition, rollback, audit, no-log validation | timed rotation runbook |
Runnable lab portfolio
- Tenant-Aware Authorization Engine
- Secure Upload Planner
- OIDC Authorization Transaction Store
- Go Webhook Gateway and SSRF Defense
- JVM Unsafe Deserialization Boundary
These exercise object/tenant authorization, upload quarantine and traversal defenses, and state/nonce/PKCE transaction binding, replay prevention, raw-body webhook authentication, bounded network destinations, and safe replacement of Java native deserialization.
Capstone - Identity-Aware Multi-Tenant Application
Build a local production-style system with:
- OIDC user login and mTLS workload identity;
- tenant isolation, RBAC plus one contextual ABAC rule;
- centralized policy checks and authorization test matrix;
- hardened sessions, password-recovery path, and SCIM lifecycle;
- KMS-like envelope encryption and rotation simulation;
- structured audit logs with redaction;
- DFD, STRIDE/abuse-case threat model, security test suite, and incident playbook.
Inject one compromised user, one over-privileged service, and one leaked signing key scenario. Show containment, detection, rotation, and residual risk.
Recommended Sources
Read the relevant RFCs rather than summaries: TLS 1.3, HTTP semantics, OAuth security best current practice, PKCE, OIDC Core, JWT/JWS, SCIM, WebAuthn. Add OWASP ASVS, API Security Top 10, Web Security Testing Guide, PortSwigger Web Security Academy labs in authorized mode, and Real-World Cryptography.
Measurable Outcomes
- 100% of protected routes appear in the authorization matrix.
- Cross-tenant and role-negative tests run in CI.
- Key or secret rotation completes without downtime in the simulation.
- Sensitive values do not appear in logs under automated canary tests.
- The learner can draw the full identity/token/session lifecycle from memory.
Common Mistakes
- Treating authentication as authorization.
- Validating a signature but not issuer, audience, nonce, time, or intended algorithm.
- Encoding all policy in routes with no testable central model.
- Homegrown cryptographic constructions.
- Relying on CORS as an access control.
- Logging tokens, assertions, recovery links, secrets, or full request bodies.
- Ignoring abuse, cost, concurrency, and business-logic limits.
Evaluation and Interview Questions
- Explain TLS 1.3 handshake goals and what TLS does not protect.
- Defend session vs token choices for browser and service clients.
- Model OAuth actors and stop authorization-code interception/replay.
- Find object- and tenant-level authorization gaps from an API specification.
- Design certificate and secret rotation with rollback.
Prompts: design Google-Docs-style sharing; secure a webhook platform; investigate a suspected JWT key leak; compare RBAC, ABAC, and ReBAC; explain SAML vs OIDC to an enterprise customer.
Portfolio and Stretch
Publish the fixture application, policy matrix, tests, threat model, and key-rotation report. Stretch: WebAuthn, SPIFFE/SPIRE, Zanzibar-style relationship tuples, DNSSEC/DANE analysis, HTTP request differential testing, or formal verification of a small authorization policy.