Authentication & Security

Proving who someone is, and never trusting anything they send you.

5 concepts · 205 minutes

• CORSThe browser rule that blocks your fetch — and why disabling it is the wrong fix.
• Storing Passwordsbcrypt/argon2, salts, and why 'we hash with SHA-256' is a breach report waiting to happen.
• Validation & InjectionNever trust the client — schema validation at the boundary, parameterised queries below it.
• Sessions vs JWTsTwo ways to remember who's calling, with genuinely different failure modes — especially logout.
• OAuth 2 & OpenID ConnectDelegated access done right — authorization vs authentication, and why the difference matters.