MODULE 01
SECOND LEARNING SERIES / WEBLook inside
Look inside
the Web.
Duru opens a note in Atlas. Follow the boundaries where data, identity, permissions and state change from browser to server.
02WEB
22 modules · 120 lessons
22 modules · 120 lessons
THE KNOWLEDGE MAP
Choose a chapter, then a lesson.
Map controls
Drag to rearrange. With keyboard focus, arrow keys move a node and Enter selects it.
YOUR FIRST STUDY SESSION
Start here if this is new to you.
Opening tabs, copying an address and editing text fields are enough. Lessons do not require Node or a terminal.
- Identify the roles · WEB-01.01 ↗
Separate browser, application and store in Core; answer the first practice question with a reason.
- Follow the first request · WEB-01.02 ↗
Advance the Core scene step by step; explain response receipt and a changed screen separately.
- Compare 200 and 404 ↗
Run Book found and Book missing in the application console; explain why status alone does not establish the screen outcome.
Core and practice are enough for a first pass. Then compare trust assumptions in Red and secure development and verification in Blue.
Prerequisites and the full learning path →7 LEARNING GROUPS / 22 MODULES / 120 LESSONS
Choose a path for your question.
Each of the map’s 22 nodes is a module. Select one to open its actual lessons. These seven groups help you choose where to begin.
The big picture
Connect browser, application and resource roles to a request and its visible outcome.
WEB-M01Connections and trustExplain the distinct outcomes of name resolution, transport and TLS decisions.
WEB-M02 · WEB-M03 · WEB-M04 · WEB-M05Addresses and HTTPCompare URL, HTTP message, representation and cache fields within one request.
WEB-M06 · WEB-M07 · WEB-M08 · WEB-M09Browser and stateIdentify the different owners of source, DOM, policy and storage state.
WEB-M10 · WEB-M11 · WEB-M12Identity and accessSeparate session or credential acceptance from resource permission decisions.
WEB-M13 · WEB-M14 · WEB-M15Servers and APIsFollow which data is changed by the server pipeline, API contract and persistence decision.
WEB-M16 · WEB-M17 · WEB-M18Data and operationsUse cache, queue, runtime and audit records to identify outcomes, coverage and recovery boundaries.
WEB-M19 · WEB-M20 · WEB-M21 · WEB-M22No lessons matched your search.
MODULE 02
Network Foundations
MODULE 03
DNS
MODULE 04
TCP, UDP and QUIC
MODULE 05
TLS and HTTPS
MODULE 06
URL, URI, Origin and Addressing
MODULE 07
HTTP Fundamentals
MODULE 08
Modern HTTP
MODULE 09
Proxies, Caches and HTTP Intermediaries
MODULE 10
How the Browser Works
WEB-10.01Browser processes and navigationWEB-10.02From HTML to DOM,layout and paintWEB-10.03JavaScript execution and the event loopWEB-10.04Resource, script, and request loadingWEB-10.05Browsing contexts, workers, and service workersWEB-10.06Observing with Developer ToolsWEB-10.S01Forms, JavaScript and DOM data flowWEB-10.S02Output contexts, XSS and DOM trust boundariesWEB-10.S03Escaping, sanitization, CSP and Trusted TypesWEB-10.S04Service worker cache, object trust and DOM clobbering
MODULE 11
The Browser Security Model
MODULE 12
State and Browser Storage
MODULE 13
Sessions
MODULE 14
Identity, Authentication and Authorization
WEB-14.01Identity, credentials, and password authenticationWEB-14.02Basic authentication, API keys, and bearer tokensWEB-14.03JWT claims and token lifecycleWEB-14.04Trust assumptions behind MFAWEB-14.05Resource authorization and tenant boundariesWEB-14.S01Account lifecycle and password verificationWEB-14.S02Recovery, passkeys, and sensitive account changesWEB-14.S03Token verification, purpose and key lifecycleWEB-14.S04Object, function and property authorization
MODULE 15
OAuth, OIDC and Modern Identity
MODULE 16
Server Side
WEB-16.01Web server, runtime, and execution modelWEB-16.02Configuration and secretsWEB-16.03Routing, middleware, and handlersWEB-16.04Service layer, business logic, and templatesWEB-16.05Static files, filesystem, and request processingWEB-16.S01Validation, normalization, and interpretation boundariesWEB-16.S02Command, template, and XML interpretation boundariesWEB-16.S03Paths, upload, and download authorizationWEB-16.S04Archives and media processing isolationWEB-16.S05Business invariants and workflow state machines
MODULE 17
APIs
WEB-17.01API contracts, endpoints, and RESTWEB-17.02Schemas, serialization and API evolutionWEB-17.03GraphQL execution modelWEB-17.04WebSocket, SSE and webhooksWEB-17.S01API inventory and authorization contractsWEB-17.S02GraphQL, streaming and message authorizationWEB-17.S03Deserialization and object reconstruction boundaries
MODULE 18
Databases and Persistence
MODULE 19
Caching, Queues and Background Processing
MODULE 20
Modern Web Application Architecture
WEB-20.01Monoliths, three-tier architecture, and SPAsWEB-20.02Microservices, gateways, and intermediariesWEB-20.03Containers, Kubernetes, serverless, and edgeWEB-20.04Third-party services and trust boundariesWEB-20.S01Server-side fetch, SSRF boundaries and egress policyWEB-20.S02BFF, SSR, hydration and server actionsWEB-20.S03Service identity and asynchronous context propagation
MODULE 21
Modern Web Deployment
WEB-21.01From source to deploymentWEB-21.02Traffic routing, scaling, and availabilityWEB-21.03Logs, metrics, and tracesWEB-21.S01Data, secrets and cryptographic key lifecycleWEB-21.S02Dependencies, CI/CD integrity and safe deploymentWEB-21.S03Resource limits, errors and fail-open boundariesWEB-21.S04Audit evidence, detection and incident scope
MODULE 22
Web Application: Core Practitioner
Web Application: Red Team Practitioner
Web Application: Blue Team Practitioner
Web Application: Full Spectrum Practitioner