Security concepts

Browser MIME and extensions are claims, not proof. A CMS image written to a public bind mount needs byte-signature checks and atomic publication before it becomes visible.

In any app with an auth gate, there's a spot that decides which routes anonymous users may see. That spot is usually a public-route allow-list. When you add a new domain and forget to update it, users hit informational…

Public contact forms, comment boxes, suggestion pages. The most abused surface on any site. Before jumping to "we must use CAPTCHA", there are lower-cost measures that already stop a lot.

OAuth 2.0 is the standard for delegating authorization without exposing user credentials. OpenID Connect sits on top to add authentication (who is this). This article covers the Authorization Code Flow with PKCE, state…

Rate limiting protects resources, controls cost, and reduces abuse. It looks simple, but in distributed systems decisions accumulate around accuracy, fairness, and UX. This article covers the fixed window, sliding windo…

Untrusted input arrives at the edges of the system. HTTP body, query, headers, environment variables, external API responses, file contents. Letting that input flow into the inner code blurs both type and meaning, and s…

JWT is a lightweight way to carry claims, but it does not by itself answer every question an authentication system needs. We cover the short-access-token / long-refresh-token pattern, invalidation strategies, algorithm…

Whenever the browser renders a page, several protective mechanisms run in concert. Same-origin policy, CORS preflight, the script allow-list of CSP, HSTS, and the isolation headers introduced after Spectre. This article…

Storing passwords in plaintext is obviously wrong, but the choice of hash function and how to use it has changed across eras. The MD5 → SHA-1 → bcrypt → scrypt → Argon2 progression is not fashion but the result of an ar…