WEB108 · Testing, Security and Deployment of Web Apps
About Course
Make your web app trustworthy before real customers use it: automated tests at every level, defensive security based on the OWASP Top 10, and a repeatable deployment with continuous integration. You will harden, test and deploy an app you built earlier.
Who it is for
Developers who can build a full-stack app and want to ship it safely and keep it working as it changes.
Prerequisites
Complete WEB105 and WEB106, or have a working Node.js API with a database that you can modify.
What you will be able to do
- Write unit, integration and end-to-end tests and explain the role of each in a test strategy.
- Identify and fix common web vulnerabilities from the OWASP Top 10 in your own code.
- Configure a continuous integration workflow that runs tests, linting and dependency checks on every push.
- Deploy an app to a free hosting tier with environment variables, HTTPS, health checks and a rollback plan.
Lessons
- Lesson 1 · A practical testing strategy
- Lesson 2 · Defensive security for web applications
- Lesson 3 · Continuous integration and deployment
- Lesson 4 · Lab and assignment
Lab: Test, harden and ship your API
You will add unit and integration tests to your WEB105/WEB106 API and an end-to-end test for one user flow. You will review the app against a security checklist, fix at least three issues, set up a GitHub Actions workflow and deploy the app with secrets stored in the host's environment settings.
Free tools: Vitest, Supertest and Playwright (free), npm audit, GitHub free with GitHub Actions, and a free hosting tier such as Render's free web service, or Docker Desktop to run the production build locally
Assessed assignment
Take an app you built in this program and prepare it for production. Deliver a test suite with at least ten unit tests, five integration tests and one end-to-end test; a security review table listing at least eight OWASP-related checks, what you found and what you changed; a CI workflow that blocks merges when tests fail; and a deployed URL or, if you prefer not to publish, a recorded run of the production container on your computer. Finish with a one-page runbook explaining how to deploy, roll back and check the app's health.
| Criterion | Weight | What excellent work looks like |
|---|---|---|
| Test suite quality | 30% | Tests cover important behavior and failure cases, run reliably and are fast enough to run on every push. |
| Security review and fixes | 30% | Checks map to real risks, findings are honest and fixes are verified by tests or evidence. |
| CI and deployment | 25% | The workflow runs on every push and pull request, secrets are not in the repository and the deployment works. |
| Runbook | 15% | Someone else could deploy, roll back and check health by following the runbook alone. |
Portfolio piece
A tested, security-reviewed and continuously integrated web app with a deployment runbook.
Next step
Continue with WEB109 · Final Project: A Full-Stack App for a Small Business · 8 hours · $56.00
Course Content
WEB108 · Testing, Security and Deployment of Web Apps (8 h)
-
Lesson 1 · A practical testing strategy
-
Lesson 2 · Defensive security for web applications
-
Lesson 3 · Continuous integration and deployment
-
Lesson 4 · Lab and assignment
-
WEB108 Assessment · Testing, Security and Deployment of Web Apps