topic / security
Security
The attacks between the browser and the server.
SQL injection, XSS, CSRF, authentication, and the difference between security that holds and security that is theater. TLS, OWASP, and why HTTPS is not a strategy.
4 articles · 0 videos · 0 traces · 0 interviews · 4 total
Articles
Authentication vs Authorization: Identity, Permissions, and Why Middleware Checks Fail
The difference between proving who you are and deciding what you can do, how RBAC and ABAC model permissions, and why authorization in middleware fails.
CSRF Tokens and SameSite Cookies: Defending the State-Changing Request
Why CSRF attacks work, why GET mutations are the root sin, and how double-submit tokens and SameSite cookies actually stop forged requests.
XSS and Why Escaping Is Not Enough: Stored, Reflected, and DOM Attacks
How stored, reflected, and DOM-based XSS actually execute, why context-aware escaping is mandatory, and how Content Security Policy contains the blast radius.
SQL Injection Is Still Number One: Attack Mechanics and Real Mitigations
How SQL injection still tops the OWASP charts: union-based and blind injection mechanics, parameterized queries, and why ORMs still leak.
Videos
// empty
No videos yet
Video coverage for this topic is planned. Watch the library page for updates.
Browse videosTraces
// empty
No traces in this topic yet
Traces are the step-by-step walkthroughs. They land as the topic matures.
Browse tracesInterviews
// empty
No interview answers yet
The question-and-answer walkthroughs for this topic are being prepared.
Browse interviewsExplore adjacent
Depth, delivered weekly
One technical dispatch a week on security and the systems around it.
One technical dispatch per week. No noise.