Skip to content

Security and privacy

Module 16 of the System Design Masterclass. Every lesson here is free to read, with no account.

  • 6 lessons
  • 1 h 24 min of reading
  1. 99Who are you: sessions, cookies, JWTHow a server knows who is calling: a session ID in a cookie, or a signed token (JWT). How long each one lasts, and how you cancel a login before it ends.24 minCore
  2. 100OAuth and single sign-on in plain wordsHow an app gets limited access to your data, or your login, from another service without ever seeing your password, and how one login opens many apps.12 minDepth
  3. 101Who may do what: roles and attributesHow a server decides what a logged-in user may do: permissions grouped into roles (RBAC), or rules that read facts about the user and the thing (ABAC).12 minDepth
  4. 102HTTPS, encryption and secretsHow HTTPS keeps a connection private, what a certificate is, how data is protected while it moves and while it is stored, and how keys and passwords are kept safe.12 minDepth
  5. 103Common attacks and fixes (OWASP)Six attacks that fit design questions, each with one fix: SQL injection, broken access control, cross-site scripting, cross-site request forgery, login guessing and server-side request forgery.12 minDepth
  6. 104Privacy and compliance: GDPR, India's DPDP ActWhat two privacy laws, the European GDPR and India's DPDP Act, ask of a system: a purpose, consent, only the data you need, deletion on time, safe storage and a fast report when data leaks.12 minDepth

The AI tutor is the part you sign up for

Reading is free for everyone. A free account adds the tutor, quizzes, notes and your progress.

Sign up free