SSRF Explained: How to Secure URL Fetchers, Webhooks, and Server-Side Requests
A defensive SSRF guide covering URL allowlists, scheme validation, DNS/IP checks, redirect revalidation, network egress restrictions, cloud metadata protection, timeouts, and response limits.
Security
Showing 13 of 22 articles
API Key Security: Generation, Storage, Scopes, Rotation, and Rate Limits
A concise API-key security guide covering secure generation, hashed storage, headers instead of URLs, scopes, environment isolation, zero-downtime rotation, revocation, monitoring, and per-key limits.
How to Build a Secure Login System: Passwords, MFA, Sessions, and Account Recovery
A concise secure-login architecture guide covering password hashing, credential-stuffing defenses, MFA/passkeys, secure session creation, password recovery, MFA recovery, and authentication security events.
SQL Injection Prevention: Parameterized Queries, Safe Dynamic SQL, and Least Privilege
A concise defensive SQL-injection guide covering prepared statements, parameterized queries, ORM raw-query risks, allowlisted dynamic identifiers, stored procedures, escaping pitfalls, and least-privilege database users.
Authorization Architecture: Policy Decisions, Enforcement, Object Checks, and Testing
A concise authorization-architecture guide covering policy decision and enforcement points, object-level checks, deny-by-default, trusted policy attributes, centralized semantics, authorization logging, and regression tests.
JWT Explained: Header, Claims, Signatures, JWS vs JWE, and Common Misconceptions
A concise explanation of JWT structure and semantics covering headers, registered claims, signatures, JWS vs JWE, signing vs encryption, validation, and when opaque tokens may be simpler.
Authentication Explained: Passwords, MFA, Passkeys, Sessions, and Federation
A concise authentication guide covering passwords, MFA, phishing-resistant passkeys/security keys, OpenID Connect federation, sessions/tokens, re-authentication, and account recovery.
Backend Security Best Practices: A Production Checklist for APIs and Services
A concise production backend security checklist covering server-side validation, authentication and authorization, parameterized database access, least privilege, secrets, TLS, file uploads, safe errors, dependency hygiene, and security logging.
RBAC Explained: Roles, Permissions, Hierarchies, and Role Explosion
A concise RBAC guide covering users, roles, permissions, role hierarchies, separation of duties, tenant-scoped roles, least privilege, role explosion, and when ABAC/ReBAC is a better fit.
How to Protect APIs from Attackers: Authentication, Authorization, Rate Limits, and Abuse Controls
A practical API defense guide covering HTTPS, authentication, object/action authorization, input validation, rate and resource limits, SSRF protection, safe errors, least privilege, and security monitoring.
OAuth Security Best Practices: PKCE, Redirect URIs, Refresh Rotation, and DPoP
A concise OAuth security guide covering Authorization Code + PKCE, exact redirect URIs, avoiding implicit token delivery, scope/audience restriction, refresh-token rotation, sender-constrained tokens, and DPoP.
OAuth Explained Simply: Authorization Code, PKCE, Access Tokens, and Refresh Tokens
A concise beginner-friendly OAuth guide covering delegated authorization, client/resource/authorization-server roles, Authorization Code + PKCE, access and refresh tokens, OpenID Connect, and the current OAuth 2.1 draft status.
Rate Limiting APIs: Token Buckets, Global Limits, Quotas, and 429 Responses
A concise API rate-limiting guide covering token buckets, caller identity, local vs global enforcement, concurrency and resource quotas, expensive-operation limits, HTTP 429, Retry-After, and downstream protection.