Authentication patterns, authorization strategies, common vulnerabilities, and the security decisions every backend developer faces.
Change the number in the URL and you're reading someone else's invoice. IDOR, also called Broken Object Level Authorization, is the top risk in the OWASP API Security list, and it survives code review because every individual endpoint looks fine. Here's why it happens, why UUIDs don't fix it, and how to make the check impossible to forget.
It works in curl, it works in Postman, and the browser still says 'blocked by CORS policy.' CORS isn't a firewall on your API. It's the browser deciding whether your JavaScript may read a response. Once you see it that way, the errors make sense, and so do the misconfigurations that turn it into a real vulnerability.
SHA-256 is a great hash function and a terrible way to store passwords — because it's fast, and fast is exactly what an attacker with your leaked database wants. Password hashing algorithms are the ones deliberately engineered to be slow, memory-hungry, and unfriendly to GPUs.
A stolen access token that lives for 30 days is a 30-day breach. Make it live 15 minutes and you have a new problem: users logged out constantly. Refresh tokens resolve that tension — short-lived access, long-lived renewal — but only if you handle rotation and theft detection right.
OAuth2 has four grant types and choosing the wrong one creates real security holes. Here's how each flow works, which one fits your application, and why the implicit flow is dead.
Sessions store state on the server. JWTs store state in the token itself. One gives you instant revocation. The other gives you stateless scaling. Neither is universally better -- the right choice depends on what you're building.