The classroom collection

Practical exercises

Choose a lesson that fits your class. Every available exercise includes a working app, student worksheet, teaching plan, rubric and reference solution.

New to web development?

Start with Exercise 04: Browser Security Basics. It needs only a browser and text editor. For dependency security, start with the beginner primer, then Exercise 01.

Security exercises, availability, OWASP category and lesson duration. Select an exercise to view details.
Exercise	Status	OWASP 2025	Time
	Available	A03	~60 min; 75–90 with primer
Scan the supplied application, investigate findings, justify dependency changes, test and rescan. Read the exercise Get the student kit Teaching plan
	Available	A03	~30 min after 01; otherwise 45–60 with equivalent knowledge
Ask an assistant for advice (or use the supplied sample), then critique, approve, and verify a repair. Read the exercise Get the student kit Teaching plan
	Available	A03	~30 min after 01; otherwise 45–60 with equivalent knowledge
Test three gate outcomes, remediate findings and verify locally; hosted GitHub work is optional and takes extra time. Read the exercise Get the student kit Teaching plan
	Available	A05	~75–90 min
Follow a beginner-friendly guided repair: post messages, observe a harmless XSS demonstration, learn the needed HTML/JS, and verify the fix. No Node/npm/server needed. Read the exercise Get the student kit Teaching plan
	Available	A01	~75–90 min
Use a supplied student portal, discover cross-user record access, repair one server-side ownership check and verify allowed/denied requests. Node 22+ required; no package installation. Read the exercise Get the student kit Teaching plan
	Available	A02	60–75 minutes after setup
Prevent debug settings from exposing internal details in error responses. Read the exercise Get the student kit Teaching plan
	Available	A04	75–90 minutes after setup
Replace reversible password storage with a supplied hashing helper; verify correct/wrong passwords and fresh salts. Node 22+; no packages. Read the exercise Get the student kit Teaching plan
	Planned	A06	Not yet estimated
Identify an unsafe account-recovery design and introduce a safer verification flow. On the roadmap. An application and teaching kit are not yet available.
	Planned	A07	Not yet estimated
Repair session handling so logging out invalidates the session. On the roadmap. An application and teaching kit are not yet available.
	Planned	A08	Not yet estimated
Reject a tampered update using a trusted integrity check. On the roadmap. An application and teaching kit are not yet available.
	Planned	A09	Not yet estimated
Record useful security events without secrets and flag suspicious activity. On the roadmap. An application and teaching kit are not yet available.
	Planned	A10	Not yet estimated
Handle unexpected failures safely without granting access or reporting success. On the roadmap. An application and teaching kit are not yet available.

Choose one package manager. Exercises 01–03 offer npm, pnpm, Yarn Classic, Yarn Berry and Bun tracks. You do not need to complete all five.

Run practice apps locally. Download and extract the code. Exercises 05–07 need Node 22+; their instructions explain how to start the local server. Do not deploy intentionally vulnerable practice apps.

Each lesson illustrates a particular weakness, not its entire OWASP category. Read the roadmap →