Security and identity

you verify the caller is who they claim to be, before you have any opinion at all about what they may do.

Authentication

you check whether this particular user is allowed to touch this particular record, not merely that they are logged in.

Authorization

you store a deliberately slow one-way hash with a per-user salt, so a stolen database is not a list of passwords.

Password hashing

you give the browser an opaque id and keep the actual session state on the server, so logging someone out is one delete.

Session cookie

the token itself carries the claims and a signature, so you can verify it without a database lookup on every request.

JSON Web Token

you keep access tokens short-lived and hand over a longer-lived credential to get a new one when they expire.

Refresh token

the user grants your app access to their data on another service without ever giving you their password.

OAuth 2.0

you use the identity provider to actually log the user in and get a verified claim about who they are, not just an access token.

OpenID Connect

you assign the user a role and let the role carry the permissions, instead of granting each capability one at a time.

Role-based access control

the rule is not "editors can edit" but "you can edit a document in your own team that is not locked".

Attribute-based access control

you give the service a database user that can only read the two tables it needs, rather than the one that can drop everything.

Principle of least privilege

you terminate TLS at the edge and then have to decide whether the internal hop after it is plaintext.

Encryption in transit

the data on disk is encrypted, which protects you against a stolen drive and against nothing that happens through your own API.

Encryption at rest

both sides present certificates, so the server proves who it is and so does the calling service.

Mutual TLS

you replace the API key on a schedule, which means the system must tolerate two valid keys at once during the changeover.

Secret rotation

you record who did what to which record and when, in a store that the application itself cannot go back and edit.

Audit log

you concatenate user input into a query string and someone closes your quote and appends a statement of their own.

SQL injection

another site makes the user's browser send an authenticated request to yours, and the cookie goes along automatically.

Cross-site request forgery

somebody captures a valid signed request and sends the exact same bytes again an hour later, and it still works.

Replay attack