OAuth 2.0 — Takeaway: An access token is a temporary, scoped credential that lets a client (app) act on behalf of a resource owner (user) at a resource server (API), without exposing the…
OpenID Connect — OpenID Connect (OIDC) is an authentication layer built on top of OAuth 2.0. It adds an ID token that contains identity claims and a UserInfo endpoint for additional profile data…
JWT — If you skip JWTs and rely solely on server‑side sessions, you’ll need a shared session store, which adds complexity and can become a bottleneck. JWTs let each service verify a…
Session authentication — Motivation When a user logs in, the backend must remember who that user is on subsequent requests. Without a mechanism to persist that identity across stateless HTTP calls, every…
ABAC — Send a request with Authorization: Bearer <token> and observe the result.
API keys — Run ts-node scripts/generateKey.ts to create a key. Store the secret securely (e.g., in Vault).
Password hashing — Tip: Keep the pepper out of the codebase; fetch it at runtime from a secrets manager.
Argon2 / bcrypt — Note: In production, use a dedicated auth service, store salts explicitly if needed, and never log raw passwords.
CSRF — Motivation When a user is logged into a web application, the browser automatically sends the session cookie with every request to that domain. A malicious site can trick the…
XSS — Motivation When a web application accepts user‑generated content (comments, profiles, posts, etc.) and later renders that content back to browsers, an attacker can inject…
SQL injection — Motivation When a backend receives user input and plugs it directly into an SQL query, an attacker can inject arbitrary SQL. This turns a harmless lookup into a full‑blown…
NoSQL injection — Motivation When a backend receives user data and uses it to build a query against a NoSQL database (MongoDB, Couchbase, DynamoDB, etc.), the developer often concatenates or merges…
SSRF — Motivation When a backend service fetches data from an external URL supplied by a user (or another service), the request can be redirected to internal resources that should be…
CORS security — Motivation When a web page served from one origin (scheme + host + port) wants to call an API on another origin, browsers enforce the Same‑Origin Policy (SOP). SOP protects users…
Clickjacking — Clickjacking is a malicious technique where an attacker tricks a user into clicking on a hidden or disguised UI element that performs an unintended action on a trusted site.
Request validation — If you have many schemas, you can cache them in Redis to avoid re‑parsing on every request. This is rarely necessary but can help in micro‑service environments.
Input sanitization — Motivation When a backend receives data from users, that data can be malformed, malicious, or simply unexpected. Input sanitization is the process of cleaning or validating that…
Secrets management — Motivation When a backend service needs to talk to a database, an external API, or a message broker, it must authenticate itself. The credentials (passwords, API keys…
Encryption at rest — Data exposure when storage media is compromised If a server, a backup disk, or a cloud object store is stolen, lost, or accessed by an attacker, the raw data on disk can be read…
Encryption in transit — Think of sending a letter through a sealed envelope that only the recipient can open.
Key rotation — Motivation Every backend service uses cryptographic keys or secrets to protect data, authenticate users, or secure communication. If a key is compromised, all data encrypted or…
Security headers — Motivation When a browser receives a response from a server, it must decide how to treat that content. If the server does not explicitly tell the browser what is safe, the browser…
OWASP Top 10 — If any wall is weak, a siege (attack) can breach the castle. The OWASP Top 10 tells you which walls are most likely to crumble.
Authentication vs Authorization — If authentication or authorization is omitted, the system behaves like an open public API: anyone can read/write any data. In production, that translates to data breaches…