CPTS-520-xu.lin-2026-01-09-09-17-58
Below is a syllabus template that includes WSU's required syllabus elements. Please complete all items highlighted in yellow.
Web Security
CPTS520
Semester and Year [tbd]
Number of Credit Hours [3]
Prerequisites [Students should have some prior experience with web development and be curious about web security, with an interest in learning real-world attacks, defenses, and secure coding techniques. Previous coursework in computer security is helpful but not required, as this course focuses specifically on security issues in the web ecosystem.]
Course Details
Day and Time: [tbd]
Meeting Location: [tbd]
Instructor Contact Information
Instructor Name: [tbd]
Instructor Contact Information: [office location, phone, email] [tbd]
Instructor Office Hours: [click here for best practices] [tbd]
TA Name: [tbd]
TA Contact Information: [office location, phone, email]: [tbd]
TA Office Hours: [click here for best practices] [tbd]
Course Description
[
Web security has become part of everyday life, where security problems impact practical aspects of our lives. Despite the fact that there is a substantial body of knowledge regarding tools and approaches for protecting web applications, information about what the actual vulnerabilities are and how they are exploited is not generally available.
The course offers a comprehensive overview of web security. Given the widespread insecurity of the modern web landscape, there is an urgent need for developers and system designers to improve their understanding of web threats. We’ll be covering the fundamentals and the state- of-the-art in web security.
]
Course Materials
Books: [Following a long-standing tradition in security courses, there is no official textbook for this course. Slides and mandatory readings should be sufficient.]
Other Materials: [Web Application Security: Exploitation and Countermeasures for Modern Web Applications, by Andrew Hoffman, O'Reilly Media (ISBN-13: 978-1492053118).]
Fees: [None]
|
Course Learning Outcomes (students will be able to:) |
Activities Supporting the Learning Outcomes | Assessment of the Learning Outcomes |
|---|---|---|
| Understand core web security principles, common vulnerabilities, and countermeasures | Lectures, discussion of real-world attack scenarios, research paper readings | Homework assignments, paper summaries, exam questions |
| Analyze the browser security model and identify client-side and server-side vulnerabilities | Lectures on browser security mechanisms, hands-on challenges, analysis of recent research papers | Homework assignments, paper summaries, exam questions |
| Apply web security mechanisms (e.g., authentication, same-origin policy, CSP, CSRF defenses) to analyze attacks and defenses |
Lectures, case studies, hands-on exercises |
Homework assignments, paper summaries, exam questions |
| Evaluate common web attacks, including CSRF, injection flaws, and code execution vulnerabilities, and understand their real-world impact |
Lectures on attack techniques, case studies, research paper discussions |
Homework assignments, paper summaries, exam questions |
| Understand online tracking techniques and their security and privacy implications |
Lectures on tracking and fingerprinting, guided analysis of tracking behaviors, paper discussions |
Homework assignments, paper summaries, exam questions |
| Analyze trade-offs between security, privacy, and usability in the design of modern web systems |
Lectures, case studies, class discussions on design choices and limitations |
Homework assignments, paper summaries, exam questions |
| Dates | Lesson Topic | Assignment | Assessment |
|---|---|---|---|
|
Week 1 |
Introduction of the Web | Paper reading | |
| Week 2 [dates] |
Client-side Technologies and Security | Homework, Paper reading, | Paper summary |
| Week 3 [dates] |
Web Authentication | Paper summary | |
| Week 4 [dates] |
Cross-domain Communication | Homework, Paper reading | Homework submission |
| Week 5 [dates] |
Attacking the Same-Origin Policy |
Paper reading | Paper summary |
| Week 6 [dates] |
Content Security Policy & Framing Attacks | Homework | Homework submission, Paper summary |
| Week 7 [dates] |
CSRF, XSSI, SRI, and Sandboxing | Paper reading | |
| Week 8 [dates] |
Database (in) Security |
Homework, Paper reading | Homework submission, Paper summary |
| Week 9 [dates] |
Code Execution Flaws |
Paper reading | Paper summary |
| Week 10 [dates] |
Assorted Server-Side Issues |
Homework, Paper reading | Homework submission, Paper summary |
| Week 11 [dates] |
Assorted Server-Side Issues |
Paper reading | Paper summary |
| Week 12 [dates] |
Infrastructure Security |
Homework | Homework submission, Paper summary |
| Week 13 [dates] |
DNS and Web Security |
Paper reading | |
| Week 14 [dates] |
Online Tracking | Homework submission, Paper summary | |
| Week 15 [dates] |
Other advanced topics as time allows | Final exam |
Expectations for Student Effort
[Describe how much time students should expect to invest in the course each week. Graduate courses should state: "For each hour of lecture equivalent, students should expect to have a minimum of two hours of work outside of class." Note that Global campus courses will automatically include credit hour equivalents in the syllabus.] [For each hour of lecture equivalent, students should expect to have a minimum of two hours of work outside of class.]
Grading [add more lines if necessary]
| Type of Assignment (tests, papers, etc) | Points | Percent of Overall Grade |
|---|---|---|
| Participation | 100 | 5% |
| Assignments | 100 | 70% |
| Final exam | 100 | 25% |
| Grade | Percent | Grade | Percent |
|---|---|---|---|
| A |
94–100% |
C | 70–73.99% |
| A- | 90–93.99% | C- | 66–69.99% |
| B+ | 86–89.99% | D+ | 62–65.99% |
| B | 82–85.99% | D | 58–61.99% |
| B- | 78–81.99% | F | 0–57.99% |
| C+ | 74–77.99% |
[Provide information about how grades will be rounded (eg, if 89% earns a B+ and 90% earns an A-, what grade is given to a student with an 89.5?]
Attendance and Make-Up Policy
[Provide details on how attendance affects final course grades. Indicate whether and how missed exams, laboratory sessions, etc. can be made up. Sample attendance statement: “Students should make all reasonable efforts to attend all class meetings. However, in the event a student is unable to attend a class, it is the responsibility of the student to inform the instructor as soon as possible, explain the reason for the absence (and provide documentation, if appropriate), and make up class work missed within a reasonable amount of time, if allowed. Missing class meetings may result in reducing the overall grade in the class.” ]
Students should make all reasonable efforts to attend all class meetings. However, in the event a student is unable to attend a class, it is the responsibility of the student to inform the instructor as soon as possible, explain the reason for the absence (and provide documentation, if appropriate), and make up class work missed within a reasonable amount of time, if allowed. Missing class meetings may result in reducing the overall grade in the class.
Academic Integrity Statement
You are responsible for reading WSU's Academic Integrity Policy, which is based on Washington State law. If you cheat in your work in this class you will:
-[Receive a failing grade (0) on the assignment or exam involved, and may receive a failing grade for the course, at the instructor’s discretion]
-Be reported to the Center for Community Standards
-Have the right to appeal my decision
-Not be able to drop the course of withdraw from the course until the appeals process is finished
If you have any questions about what you can and cannot do in this course, ask me.
If you want to ask for a change in my decision about academic integrity, use the form at the Center for Community Standards website. You must submit this request within 21 calendar days of the decision.