Topic · 12 lessons in 8 series
Authentication and authorization
How login works and how to keep it safe: passwords, sessions, cookies, JWTs, OAuth and OpenID Connect, and deciding what each user is allowed to do.
System DesignWhole series →
- Authentication vs Authorization: Sessions, Cookies & JWTEvery endpoint checked “is the user logged in?” — and changing one number in the URL showed another customer's invoice. Authentication vs authorization, storing passwords, MFA and passkeys, sessions vs JWTs (with a live token to tamper with), and RBAC, ABAC and ReBAC.12 min
- OAuth 2.0 & OpenID Connect ExplainedApps used to ask for your Google password to print your photos. How OAuth 2.0 hands out limited, expiring, revocable “valet keys” instead, how OpenID Connect adds login on top, and the flows and checks that keep it secure.12 min
The Browser ContractWhole series →
- Storage in the Browser: Cookies, localStorage, sessionStorage and IndexedDBHow long each one lasts, how big it can be, and who can read it: the tab, the site, the server or JavaScript. It ends with a table that answers: where should this data go?15 min
- Sessions vs JWT: Stateful vs Stateless LoginWhat a signed JWT is, how it is different from a plain session ID, and where “stateless” stops helping: logging out, expiry, refresh tokens and the claims you must check.20 min
- Where Do Tokens Live? XSS, CSRF and the Storage Trade-offlocalStorage lets XSS steal tokens. Cookies let CSRF attacks use you. Safe patterns: HttpOnly cookies with SameSite or CSRF tokens, access tokens kept in memory, and a backend-for-frontend.18 min
Backend in DepthWhole series →
Scenario DebuggingWhole series →
Full-Stack QuestionsWhole series →
Security for DevelopersWhole series →
- Passwords and Login: Hashing, Sessions, MFA and Rate LimitsWhy you never store passwords, hashing with a salt (scrypt and Argon2), safe sessions and JWT mistakes, password reset flows, MFA, and stopping brute force.16 min
- Access Control: IDOR, Roles and Mass AssignmentThe number one web risk: checking who you are but not what you may do. IDOR with a real example, deny by default, roles and ownership checks, and mass assignment.14 min