This workshop is here to give you the skills you need to make your APIs secure. We're going to think like an attacker to test APIs and like a defender to figure out the best ways to protect them. With deep-dive talks, real-world demos, fun quizzes, and hands-on labs, you'll learn how to lock down your APIs.
During this hands-on training, we'll explore:

The security model of API-based web applications

Recognizing and addressing authorization failures

Understanding Broken Object Property Level Authorization (BOPLA)

Fixing Broken Object Level Authorization (BOLA)

Testing the security of APIs that use JWTs

Best practices for making JWTs secure in modern APIs

Identifying, exploiting, and fixing Server-Side Request Forgery (SSRF) issues

Understanding Cross-Origin Resource Sharing (CORS)

Configuring secure CORS policies for various use cases

Tracking user authentication securely with sessions or tokens

Relying on OAuth 2.0/2.1 for securing APIs

Q & A throughout the workshop to clear up any doubts


This workshop is about more than theory. We're all about giving you practical security tips you can use right away as an API developer. We dig into the root causes of API threats and how to handle them. We don't just skim the surface of problems and solutions - we get into the why's and how's, looking at common fixes, why some fall short, and which ones are currently the best way to go.
By the end of this workshop, you'll be up-to-speed on the best practices for API security. You'll also leave with a handy list of steps to check and boost the security of your applications.




This training is perfect for developers and architects who work a lot with APIs. If your role involves building, testing, or designing modern apps, this workshop will give you a thorough, up-to-date understanding of the best ways to keep things secure. We'll often use NodeJS, Flask, and Spring Boot in our code examples and demos, but you'll easily be able to apply what you learn to other languages and frameworks.




These testimonials from previous workshops give you a good idea of what to expect:

Trainer is great and an expert in the domain. All of the topics are very relevant. Practical examples for most of the topics. Excellent communication and addressing of questions.

Even though the topic is broad, there was no single moment where my focus went astray. Philippe talks in a way to keep you interested to listen to him.

I liked the the pleasant and relaxed way of speaking and the fresh style of presentation of this kind of dry stuff :)

Philippe is a friendly and knowledgable trainer and delivered an interesting course that was well presented. Questions were answered promptly and in a detailed way.


To participate in this training, you should have some experience with building API-based applications. Knowledge of application security can be helpful, but is not required.




To participate in the lab sessions, participants need a computer with a full-featured modern browser installed (preferably Chrome).


2 Days

14-15 Sept

Bulletproof APIs: Hands-On API Security

Security

To be fair, the people who abuse this term are also the people who probably fall under this category. I prefer “Agentic Programming” instead. I have pushed thousands of lines of code in production using agentic programming. Code that would have taken me months to write myself now takes merely days.

In this workshop, we’ll explore agentic programming as a disciplined engineering practice, not a toy.
Using Claude Code, I’ll show how to collaborate with AI agents to produce maintainable, reviewable, and production-ready code, without surrendering architectural control, correctness, or performance.

What Claude Code is, how it works, and how you should use it.

Designing clear agent boundaries and responsibilities.

How to turn vague intent into explicit, testable instructions.

Create plans that can run for hours on end, generating and testing code as they go.

This is not a “let the AI take the wheel” session. It’s about teaching the AI to work like a senior engineer, while you stay firmly in charge. If you believe AI coding tools are dangerous, flaky, or fundamentally incompatible with serious software engineering, then this workshop is for you.



A laptop with your favourite IDE installed

Node (we will also cover .NET, but it is optional)

Vibe Coding for Production

This hands-on workshop will equip you with practical skills to implement your own MCP servers, clients, and MCP-enabled knowledge bases — and build interactive AI applications that connect your organizational knowledge to advanced AI models in a controlled, secure manner.

Day 1: Foundations — Servers & Knowledge

Introduction to Model Context Protocol and its business applications

Core MCP concepts: Server/client architecture, agents, resources, and tool calling

RAG fundamentals and architecture patterns

Hands-on exercises: Building a local MCP server and RAG pipeline

MCP Apps: Creating interactive AI-powered applications

MCP Clients: Building your own host applications

Deployment options: Remote MCPs, Cloud providers and hosting alternatives

Preparing for production: Security considerations and optimization strategies

Final exercise: Building an MCP App that exposes your knowledge base

Basic Python or JavaScript programming knowledge

Familiarity with AI/ML concepts (helpful but not required)

Laptop with necessary development environment

This training is targeted at developers and people with a medium+ technical skill level and interest for AI.



Bring your laptop with your preferred IDE and either Python or Node installed. We recommend an AI-coding agent like Claude Code, Cursor or GitHub Copilot, but not required!


 
You need access to an LLM provider with an embedding model like OpenAI or Azure Foundry, but you can also use Ollama if you would like to run everything locally and free.

Context Is King: Building AI Apps with MCP & RAG

What are the different architectures? Why should we choose one over the other? Or should we choose a combination of them for some applications? How do we make such decisions? What should be the process or the approach that will lead us towards selecting a more suitable or appropriate architecture, one that comes from proper analysis rather than infatuation or desire to build something because that's seems to be the current trend.


In this workshop, we will take a very systemic approach to going from requirements to choosing suitable architectures. We will cover the following topics, not by simple talking about these, but by way of hands-on exercises and interactive and collaborative sessions:

- Challenges with selecting Architectures
-  Functional and non-functional requirements
- Evaluating trade offs
- Methodical Mapping from requirements to patterns
- Architectural Patterns
- Underpinnings of monoliths and distributed architectures
- Hands-on exercises to analyze application requirements
- Groups labs to evaluate the architectural patterns for different application characteristics
- Using AI to assist with requirements analysis
- Cautiously Using AI to guide along the selection process
- Next steps beyond choosing architecture




- Senior programmers
- Team leads*Architects
- Technical managers and directors



Dr. Venkat Subramaniam is an award-winning author, founder of Agile Developer, Inc., an instructional professor at the University of Houston, and creator of the dev2next and Arc of AI conferences.
He has trained and mentored thousands of software developers in the US, Canada, Europe, Asia, and Africa, and is a regularly-invited speaker at several international conferences. Venkat helps his clients effectively apply and succeed with sustainable agile practices on their software projects.
Venkat is a (co)author of multiple technical books, including the 2007 Jolt Productivity award winning book Practices of an Agile Developer. You can find a list of his books at <

NDC { Oslo }

Workshops

09:00 - 17:00 (UTC+02)

Vibe Coding for Production

Nick Chapsas

Context Is King: Building AI Apps with MCP & RAG

Aleksander Stensby

Bulletproof APIs: Hands-On API Security

Philippe De Ryck

Architectural Patterns: Common Solutions for Building Large Scale Systems

Venkat Subramaniam