Google Code University hosts tutorials on a variety of topics including Web Security. A recently added tutorial is called "Web Application Exploits and Defenses". A blog post announcing this has an interesting statement -The maxim, "given enough eyeballs, all bugs are shallow" is only true if the eyeballs know what to look for.
For web developers interested in security, Microsoft E-Learning offers a two-part course called Microsoft Security Guidance Training for Developers
Also see:
Google Browser Security Handbook
OWASP Development Guide