Course overview
Service-to-Service Security from Scratch
Start with two servers that answer anybody, and finish with two that prove which service is calling and which user the call is for, using credentials that expire in sixty seconds.
15 lessons10 hr 55 min
First Connection
2 lessons- 01Run Two Servers That Never FinishBuild one Go server and one TypeScript server that each claim a port and wait forever, then prove they are listening and learn to read the two errors beginners confuse most.25 min
- 02Make the Two Servers TalkGive each service a /health endpoint and a background loop that calls the other one, then discover the problem that drives the rest of the course — neither server knows who is calling.30 min
Shared Secrets
2 lessons- 03Guard the API with a Shared KeyAdd the credential everybody reaches for first — one shared string in a header — and learn why comparing a secret with == can leak it one character at a time.30 min
- 04Why a Shared Key Is Not an IdentityWatch your own API key travel across the network in plain text, then trace each weakness to the bearer, sharing, or lifecycle choice that causes it.25 min
Transport Security
3 lessons- 05Certificates, Keys, and Your Own CABuild a private certificate authority and one certificate per service with a short shell script, then open the files and read what is actually inside them.40 min
- 06Encrypt the Connection with TLSServe both services over HTTPS with the certificates you just made, pin trust to your own certificate authority, and see exactly which of Lesson 4's five weaknesses this fixes.40 min
- 07Mutual TLS - Both Sides Prove Who They AreRequire a certificate from the caller as well as the server, read a verified service name off the connection, and delete the shared password from your codebase entirely.40 min
User Identity
3 lessons- 08The Confused Deputy and the Token That Fixes ItUnderstand why a trusted service can be tricked into fetching the wrong user's data, then design the second credential that carries the user — a short-lived, audience-scoped token nobody can mint for themselves.25 min
- 09Build the Auth Server That Mints TokensWrite a third Go program that reads the caller's identity off their certificate, exchanges a user session for a sixty-second signed token, and publishes the public key anyone needs to check it.45 min
- 10Verify a Token, Then DecideExchange a session for a cached token, run the six checks that turn a signed string into a trustworthy statement, and then answer the question identity never answers — may this caller have this record?60 min
Workload Identity
4 lessons- 11Certificates That Live Sixty SecondsBuild a small workload API that identifies a process by asking the kernel who it is, then hands it a certificate valid for one minute — no password, no bootstrap secret, nothing on disk.45 min
- 12Build the Identity LibraryWrite the small amount of shared code that every program needs to fetch a short-lived identity, verify a peer by SPIFFE ID rather than hostname, and keep rotating without a restart.40 min
- 13Migrate Every Program to Short-Lived IdentityPoint all four programs at the identity library, delete the certificates folder for good, then discover why a rotated certificate may never have been presented at all.45 min
- 14Fuse Both Layers into One ProofFollow a single request through both credentials, defend the check that looks redundant, measure what short-lived identity actually costs, and see where you get all of this in production without writing it.35 min