Security
- Security6 min read
Active Directory explained
What Active Directory is, how domains, domain controllers, forests and organisational units fit together, how signing in works with Kerberos and LDAP, and how it differs from Microsoft Entra ID.
- Security6 min read
API keys and how to protect them
What API keys are and how to handle them safely as a consumer and as a provider: keeping keys out of code, git and front ends, environment variables and secret managers, restricting and rotating keys, what to do after a leak, and how to issue, hash and scope keys in your own API.
- Security6 min read
Certificates and certificate authorities
A practical guide to X.509 certificates: what is inside one, how certificate authorities validate and sign them, DV, OV and EV, creating keys and signing requests with OpenSSL, self-signed and private CAs, keystores and truststores in Java, mutual TLS, revocation and renewal.
- Security5 min read
CORS explained
Why browsers block cross-origin requests and how CORS lets servers allow them: the same-origin policy, simple and preflighted requests, the Access-Control headers, credentials and cookies, configuring CORS in Express, Spring and Nginx, and debugging the famous console error.
- Security6 min read
CSRF explained
How cross-site request forgery works and how to stop it: why browsers attach cookies to cross-site requests, a concrete attack, SameSite cookies, CSRF tokens and the synchronizer and double-submit patterns, Origin checks, framework defaults in Spring, Django and Express, and when token-based APIs are not affected.
- Security5 min read
How HTTPS and TLS work
A deeper look at TLS, the protocol behind HTTPS: what it guarantees, the TLS 1.3 handshake step by step, key exchange and forward secrecy, certificates and the chain of trust, how browsers check them, Let's Encrypt, and the configuration mistakes to avoid.
- Security6 min read
JAAS: authentication in Java
Java's built-in, pluggable authentication framework: LoginContext, LoginModule, CallbackHandler and Subject, the configuration file and its flags, a working login module, and where JAAS still fits today.
- Security5 min read
Kerberos explained
How Kerberos signs you in once and opens many services without sending your password around: the KDC, tickets, the TGT and service tickets, the three-step exchange, why clocks matter, SPNs and keytabs, and the attacks to know about.
- Security5 min read
LDAP explained
The protocol behind company directories: how LDAP organises entries into a tree, what a distinguished name is, how binds and searches work, how to write a search filter, and how to use it safely.
- Security5 min read
OpenID Connect explained
The identity layer on top of OAuth 2.0: what OIDC adds, the ID token and its claims, the discovery document and JWKS, scopes like openid and email, and how "Sign in with" buttons actually prove who you are.
- Security5 min read
Passkeys and WebAuthn
How passkeys replace passwords: public-key credentials created with WebAuthn, why they cannot be phished, registration and sign-in step by step, synced and device-bound passkeys, what the server stores, and how to roll them out without locking people out.
- Security5 min read
RADIUS authentication explained
How RADIUS checks who may join a Wi-Fi network or a VPN: the NAS, the server and the shared secret, the four messages, accounting, 802.1X with EAP, the protocol's weaknesses and how RadSec fixes them.
- Security5 min read
RBAC vs ABAC
Two models for deciding who can do what: role-based access control with users, roles and permissions, its strengths and role explosion, attribute-based access control with policies over user, resource, action and context, relationship-based access (ReBAC), implementing checks in code, policy engines such as OPA and Cedar, and how to choose.
- Security5 min read
SAML and single sign-on
How SAML lets one company login open many applications: identity providers and service providers, assertions, the redirect and POST bindings, SP- and IdP-initiated flows, metadata and certificates, and how SAML compares with OpenID Connect.
- Security6 min read
Secrets management
How to handle passwords, API keys, certificates and tokens across development and production: what counts as a secret, why environment variables and config files are only part of the answer, secret managers such as Vault and cloud services, injecting secrets into apps and Kubernetes, dynamic and short-lived credentials, rotation, and preventing leaks.
- Security6 min read
Sessions vs tokens
Server-side sessions and self-contained tokens such as JWTs compared: how each works, revocation, scaling, storage in the browser, XSS and CSRF exposure, access and refresh tokens, the backend-for-frontend pattern, mobile apps and APIs, and a clear recommendation for typical web applications.
- Security5 min read
SQL injection explained
How SQL injection works and how to prevent it for good: a vulnerable login and search with real payloads, what attackers can do, parameterised queries in Java, Python and Node.js, ORMs and their raw-query traps, dynamic identifiers, least privilege, and testing.
- Security6 min read
SSH keys explained
How SSH key authentication works and how to use it safely: public and private keys, generating Ed25519 keys, authorized_keys on servers, passphrases and ssh-agent, the ~/.ssh/config file, host key verification and known_hosts, hardening the SSH server, agent forwarding risks, and hardware-backed keys.
- Security5 min read
Storing passwords: bcrypt, scrypt and Argon2
How to store passwords safely: why plain text, encryption and fast hashes like SHA-256 all fail, what salts and slow hashing do, how bcrypt, scrypt and Argon2 compare, working code in Python and Java, choosing parameters, and upgrading old hashes.
- Security4 min read
TACACS+ vs RADIUS
The two AAA protocols network teams use, side by side: what TACACS+ is for, how it separates authentication, authorisation and accounting, per-command authorisation for routers and switches, encryption and transport differences, and when to use each.