Learn with AI.
Verify before you trust it.

Authentication vs authorization

Authentication identifies the caller. Authorization decides whether that caller may do this action on this resource.

Passwords done right

Hash with a memory-hard function and a unique salt. Argon2 replaced bcrypt because bcrypt's tiny memory cost is cheap to parallelize.

After Authentication vs authorization

Sessions vs tokens

Sessions can be deleted on logout. Self-contained tokens stay valid until they expire unless you add a revocation list.

After Passwords done right

JWTs in depth

Header, payload, and signature. Asymmetric keys so verifiers do not hold the signing secret. Short access tokens, rotated refresh tokens, and HttpOnly cookies instead of localStorage.

After Sessions vs tokens

Building a login flow

Hash on register, verify on login, name an HttpOnly Secure SameSite cookie, and refuse the notes route when the session is missing.

After JWTs in depth

OAuth and sign in with X

Delegated login, why the implicit flow put tokens in the URL, and how PKCE keeps the token off the URL.

After Building a login flow

Passkeys and WebAuthn

WebAuthn binds a key pair to the origin. A phishing site can look perfect and still cannot obtain a signature.

After OAuth and sign in with X

Multi-factor authentication

TOTP codes change with the time step. Adaptive MFA asks for that code when the risk changes, not on every quiet login.

After Passkeys and WebAuthn

Build vs buy

Clerk, Auth0, Supabase Auth, and WorkOS take on passwords, sessions, and federation. You still own product rules, redirects, and what happens when the vendor is down.

After Multi-factor authentication

Authorization models

Three ways to decide a yes. The inputs differ, and so do the bugs.

After Build vs buy

BOLA and broken authorization

The broken notes route checks that someone is logged in, then returns whatever id was asked for. The fix compares the owner.

After Authorization models

Protecting routes in practice

Auth middleware on an Express notes route, and a React component that renders Sign in until it has a user.

After BOLA and broken authorization

The real OWASP Top 10

What broken access control, injection, misconfiguration, and the rest look like in request-handling code.

After Protecting routes in practice

CSRF, XSS, and cookie security

Escape text that becomes markup. SameSite and a token stop a cross-site form from riding the cookie.

After The real OWASP Top 10

Session fixation and token revocation

Issue a new id at login, issue another when the role changes, and delete the id on logout.

After CSRF, XSS, and cookie security

Rate limiting and user enumeration

Put the existing rate limit on these two routes, and return the same body whether or not the account exists.

After Session fixation and token revocation

Secrets management in depth

Do not commit secrets, reject them in a pre-commit scan, and inject them at runtime.

After Rate limiting and user enumeration

Dependency and supply-chain security

A known-vulnerable release is an attack surface because your server executes it. Pin it, update the fix, and notice when the tarball changes.

After Secrets management in depth

Security as an ongoing practice

A short close: review the change for the bugs this track already named, and keep doing that.

After Dependency and supply-chain security