Web security
in the real world.

Spot the weakness in a real web flow, then choose the control that actually fixes it.