COURSES

Content

The course covers web architecture, HTTP/HTTPS, browser security policies, and major web vulnerabilities such as XSS, CSRF, and SQL injection. It also addresses secure authentication, access control, tracking and fingerprinting, UI attacks, browser extensions, bot detection, and server-side flaws. Practical defence strategies are discussed throughout. Every lecture includes homework, typically involving exploiting and fixing vulnerabilities. Students are expected to have basic skills in web application development (HTML, JavaScript and PHP).

Learning outcomes

At the end of the course, students will be able to: 

- Identify, exploit, and mitigate common web vulnerabilities (XSS, CSRF, SQLi). 

- Understand key web security concepts and protocols (HTTP, cookies, SOP, CSP). 

- Apply security best practices in authentication, authorization, and session management. 

- Analyze browser behaviors, tracking methods, and server-side vulnerabilities. 

- Use developer and security tools to evaluate and improve web application security. 

Programme

Topics covered in the course include: 

1. Web, HTTP protocol, HTTPS, Cookies 

2. Same-Origin Policy (SOP) 

3. Cross-Site Request Forgery (CSRF) 

4. Cross-Site Scripting (XSS) 

5. Content Security Policy (CSP) 

6. User Interface (UI) attacks 

7. Tracking and fingerprinting 

8. Browser extensions 

9. Bots and CAPTCHAs 

10. Authentication and session management 

11. Authorization 

12. SQL Injection (SQLi) 

13. Server-side vulnerabilities
    
    
14. Server-side vulnerabilities 2 
    
    
15. Attack detection and prevention

Teaching format

The course is 100% web-based and can be completed asynchronously.

The course consists of pre-recorded online lectures and homework tasks. The list of independent work will be given in the lectures.

The use of AI tools for assignments is prohibited.

The E-learning environment is UTartu Moodle.

Assessment method(s)

Differentiated (A, B, C, D, E, F, not present)

Final grade consists of homework (70%) and test (30%).

The test is optional and cannot be retaken.

Lecturers

Arnis Paršovs

Course dates

This course takes place in the second semester of the academic year 2026/2027. It starts in the week of February 8.  

This is 100% self-learning course with weekly homework deadlines. Info on course schedule is available here.

ENLIGHT students will be able to take the test remotely via Internet in May, exact time will be specified.   

Entry requirements: Students from all ENLIGHT partner universities and from all disciplines with basic programming skills are eligible to participate.

For application, please fill in this form (link available from November 2). Apply by January 15, 2027. The University of Tartu will select the permitted number of students and inform the admitted students as soon as possible. 

You can find the UTartu course description here.

Contact your ENLIGHT coordinator for further information on the application process or consult the linked information:

• University of the Basque Country: This email address is being protected from spambots. You need JavaScript enabled to view it.
• University of Bern: This email address is being protected from spambots. You need JavaScript enabled to view it., see application instructions for students at the University of Bern
• University of Bordeaux: This email address is being protected from spambots. You need JavaScript enabled to view it.  
• Comenius University Bratislava: This email address is being protected from spambots. You need JavaScript enabled to view it. , see application instructions for students at the Comenius University Bratislava
• University of Galway: This email address is being protected from spambots. You need JavaScript enabled to view it.
• Ghent University: This email address is being protected from spambots. You need JavaScript enabled to view it., see information about BIP's and virtual courses
• University of Groningen: This email address is being protected from spambots. You need JavaScript enabled to view it.
• University of Göttingen: This email address is being protected from spambots. You need JavaScript enabled to view it. (for BIP’s) or This email address is being protected from spambots. You need JavaScript enabled to view it. (other courses)
• Uppsala University: This email address is being protected from spambots. You need JavaScript enabled to view it., see application instructions for students at Uppsala University

Arnis Paršovs - This email address is being protected from spambots. You need JavaScript enabled to view it.