This chapter explains the difference between authentication and authorization from the angles of ordering, status codes for failure, and where implementation lives. It covers the three authentication factors, how to carry authentication state via sessions vs. tokens, authorization models like RBAC, and how to structure a written answer.
Explains the design of authentication and authorization in DDD and clean architecture. Covers the division of responsibilities where authentication and authorization live in the presentation layer and business rules in the domain layer, the structure of JWT, the implementation with Laravel × tymon/jwt-auth, access/refresh tokens, and role-based authorization.
This chapter compares localStorage, sessionStorage, and cookies across five axes — whether they reach the server, what separates them, how long they last, how the size limit applies, and whether tabs share them. It covers why the capacity numbers run in opposite directions as floors and ceilings, and where to put authentication tokens.
This chapter covers, for junior engineers and from a database-design angle, the difference between authentication and authorization, password hashing (bcrypt/argon2), session management, multi-factor authentication (MFA / TOTP), account lockout (OWASP/NIST compliant), and audit logs.
This chapter covers, for junior engineers, OAuth 2.0's four roles, Authorization Code Flow + PKCE, OpenID Connect's ID Token (JWT), the modern standard following Implicit Flow's deprecation under RFC 9700, and DB design for social login.
This chapter starts from the difference between character set and encoding scheme. It covers four ways of counting characters, normalization for same-looking-different-bytes, collation deciding sort order and comparison, byte-based storage limits, and vulnerabilities from interpretation boundaries being multiple.
This chapter organizes major web application attacks — XSS, CSRF, SQL injection — from "conditions that let each succeed" and derives defenses by breaking those conditions. It covers the difference between escaping and placeholders, the relationship between CSRF tokens and SameSite, and why access-control failures rank
This chapter organizes cookie attributes by "where to send", "how long to keep", and "who can read", and explains the incidents that arise from the scope not matching origin. It covers that Domain widens into subdomains and that SameSite is evaluated at the site level.
Learn the syntax and evaluation order of IAM policy JSON and the relationship between roles and trust policies, then create a dedicated IAM user and group for Terraform execution to move off administrator-equivalent credentials. It also covers IAM self-escalation paths and how a permissions boundary sets an upper bound.
This chapter defines an origin as the triple of scheme, host, and port, and explains that the same-origin policy blocks reading, not sending. It covers when preflight is triggered, why wildcard and credentials can't be combined, and why Vary is needed.
This chapter explains that among the three properties TLS guarantees, what the certificate covers is the other side's identity. It covers certificate chain verification, that intermediate certificate delivery is the server's responsibility, what changes with the location of TLS termination, and reading certificate errors.