Portswiggers web security course is good, instead of releasing a 3rd version of the Web Application Hackers handbook (which was the standard goto appsec book) they developed this free course with practical exercises.
https://portswigger.net/web-security