Illustration of a working environmentEnrolment opening soon
Cookies, sessions and browser state
Trace a session from login to logout and understand the browser's and server's responsibilities. Learn to diagnose cookie attributes, rotation flaws, CSRF and subdomain dependencies, then choose protections for the specific flow.
PLN 349planned price including tax
In your browser · No installation · Tutor and narration
Open your browser. Start learning.
Do not spend your first evening configuring an environment. The application, tools and task context are in one place. You do not need Docker, a VPN, a virtual machine or paid software.
A virtual tutor walks you through the example and highlights important parts of the application, code or tool. Connect the instruction to what is happening on screen.
Narration explains the mechanism, decision and result. Pause the guidance, return to an earlier step and work through it at your own pace.
Take over in the exercise: change data, run a test or make a decision. Compare the result and improve your solution using the explanation.
One environment, without switching between a video and a local installation. Tools fit the topic: from HTTP requests and code to a terminal, calculator or document. Practice in simulators and prepared cases, without attacking other people's systems.
What will you be able to do?
Connect browser settings to what the server accepts. Use this to examine the entire login and logout process.
You treat a cookie's presence as evidence of an active session.
For a selected request, identify whether the cookie was attached and whether the application considered the session valid.
You test login but skip session changes and termination.
Build a state matrix. Replay an earlier identifier and compare behavior before and after the change.
You assume SameSite or HttpOnly solves every problem.
Explain what a flag does not protect. Choose a cross-site or cross-subdomain test and a server-side control.
Useful for reviewing login, integrating SSO, diagnosing session issues and preparing regression tests for an application team.
Connect each skill to a concrete work product. Return to explanations while you practice.
A syllabus backed by materials
See what makes up the syllabus: lessons, explanations, examples and exercises. The figures below describe different types of materials.
The figures describe the English-language source materials. The waiting list is for the planned Polish edition. These counts do not mean its translation is complete. Demonstration steps, examples and tasks are different units, not hours of video or counts of unique vulnerabilities.
Entry point
Available in Polish and English — you can switch language at any time. Command names, code snippets and standard identifiers remain in their original form.
How you learn
The tutor walks through an example and explains each decision. In the exercise, return to the context, check the result and improve your answer.
Goal, constraints and inputs. Know what you are testing and why.
Watch a demonstration with tutor commentary, step by step.
Work with data, a tool or a scenario. Compare the result with your expectation.
Justify your decision and understand its limitations. Return to anything that needs improvement.
Exercises use simulators and selected mechanisms that run in the browser. They do not require attacking other people's systems.
Planned syllabus
Each area develops a specific skill. Learn not only the topic but also the action and outcome that learning leads to.
Each topic includes a skill and a concrete exercise outcome.
I want to join the listSee how the browser stores a cookie and when the server recognizes a session. Compare the storage record, Set-Cookie header and Cookie sent in a request. Distinguish a local value change from application-granted permissions.
Tutor-guided exercise
Analyze Domain, Path, Secure, HttpOnly, expiry and the __Host- and __Secure- prefixes. Test which settings restrict reading, transmission or cookie acceptance. Connect configuration to the code that sets browser state.
Tutor-guided exercise
Compare SameSite Strict, Lax and None in same-site and cross-site requests. Consider scheme, domain, method and navigation context. Choose CSRF controls for the operation's intent, not just cookie presence.
Tutor-guided exercise
Trace an identifier supplied before login, its acceptance and subsequent replay. Compare versions with and without rotation. Describe when the application should break the link to the old identifier.
Tutor-guided exercise
Examine identifier changes on login and privilege changes, and the session's relationship to a refresh token. Prepare tests with old and new values. Check that invalidation remains effective when the server is requested again.
Tutor-guided exercise
Compare deleting a browser cookie with invalidating the server-side session. Practice replaying an earlier identifier and checking session limits. Record the result as an observation of a specific lifecycle stage.
Tutor-guided exercise
Test which cookies a neighboring subdomain can set and what happens with duplicate names. Compare domain scope, path and prefixes. Choose settings that limit the influence of a less-trusted part of the site.
Tutor-guided exercise
Compare cookies with localStorage, sessionStorage and other application state. In a script-access scenario, distinguish reading a secret from making a request in the user's session. Use this to choose protection for browser-accessible tokens and data.
Tutor-guided exercise
Explore how an embedded service's state depends on the top-level site and the role of partitioned cookies. Compare same-site and cross-site situations and consent context. Turn observations into technical session and privacy recommendations.
Tutor-guided exercise
Assemble a session-state map and tests before and after the change. Connect cookie settings to the server response and check that the fix preserves legitimate login. Prepare a clear justification for the authentication team.
Workshop with prepared data
In practice
Each case has context, a concrete action and an outcome. The goal is not to memorize a command but to understand why the result changed.
Work through pre-login, authenticated, refreshed and logged-out states. Compare local identifiers with server behavior and test replay of an earlier value.
Work productA session-state matrix with rotation and invalidation tests.
Compare cookie transmission with different SameSite, domain and scheme settings. Analyze the influence of a neighboring subdomain and an embedded service's context.
Work productJustified cookie configuration and cases that test its behavior.
Certificate of completion
When you complete the course, the certificate is issued automatically and emailed to you. It shows your name, the date of issue and a unique code, and its second page lists the course scope.
Code verification: cyberszkola.pl/verify
Upcoming standalone course
Planned course price
Polish edition · Launch date not yet announced
Notify me at launchJoining is free. Before sales open, you will receive the date, full scope and purchase terms. We are not taking payments today. This is a separate interest list, not a place reservation or purchase.
For companies and teams
Compatible with LMS platforms including:
and other platforms that support e-learning standards.
Price for companies
Delivery into your company's own LMS from 50 licences.
Ask for a quoteWrite to kontakt@cyberszkola.pl: the number of people, the courses you want and your LMS, if you use one.
Project author
Creator of Cyberwiedza, cyberszkola and AI SecLabs. In these courses, I connect explanations of mechanisms with practice, observation and decisions you need to justify.
Running a command is not enough. What matters is what its output confirms, what it does not confirm and what the next step should be.
More about the authorBefore joining
Connect them into a complete flow. Check not only an attribute setting but also cookie acceptance, reading, transmission and the server's decision. This helps diagnose flaws that a settings list alone does not reveal.
No. The knowledge also helps with login design, frontend integrations and session management. Exercises lead to rules and tests useful to an application development team.
No. This is an upcoming course announcement and an interest list. Joining is not a purchase, a place reservation or a commitment to pay.
The launch date, price and access terms will be announced before sales open. The interest list is how we send that information.
The course is available in Polish and in English — you can switch language at any time, and lessons, exercise explanations and narration exist in both. Commands, code and tool names keep their original syntax, as used in everyday work.
No. All course exercises run in your browser on a computer with internet access. Training applications, terminals, editors and workshops are part of the platform. You do not install Docker, a virtual machine or a VPN, and you do not need paid external tools.
No. You work in an interactive environment. A virtual tutor highlights important elements, and narration explains the action and its result. Pause the lesson, return to earlier steps and run your own experiments. This guidance is built into the course, not individual consultation with a person.
No. You use training applications, simulators and prepared data. Learn the mechanism and its limitations in a safe environment. External resources are supplementary, not required to complete the exercises.
Yes, a certificate of completion. When you complete the course, you receive a certificate in English with a unique code that anyone can check at cyberszkola.pl/verify. It confirms completion of the course and is issued by the author; it is not an industry certification. We do not promise employment.
No. These are independently authored courses using public references and original cases. They do not replace licensed standards, accreditation or qualifications required in regulated industries.
Join the waitlist
Leave your email address. We will send you news of enrollment, the syllabus and first-edition terms. You will not need to keep checking this page.
Planned price: PLN 349 including tax