Security
- Security6 min read
The OWASP Top 10
A developer's tour of the OWASP Top 10 web application security risks: broken access control, cryptographic failures, injection, insecure design, misconfiguration, vulnerable components, authentication failures, integrity failures, logging gaps and SSRF, with an example and the key defences for each.
- Security5 min read
Two-factor authentication and TOTP
How the six-digit codes in authenticator apps work: the shared secret behind the QR code, HMAC and the 30-second clock, a working TOTP implementation, verifying codes safely, backup codes, and how TOTP compares with SMS and passkeys.
- Security5 min read
XSS explained
How cross-site scripting works and how to prevent it: stored, reflected and DOM-based XSS with examples, what an attacker can do with a script on your page, context-aware output encoding, the safe defaults of modern frameworks and their escape hatches, sanitising HTML, Content Security Policy, and HttpOnly cookies.
- Security6 min read
OAuth 2.0 and "Sign in with Google", step by step
What happens between clicking "Sign in with Google" and landing back on the site signed in: the authorization code flow, PKCE, state, the ID token, and the mistakes that let someone else's login become yours.
- Security7 min read
JWT from the ground up
What is actually inside a JSON Web Token, how the signature makes it trustworthy, why you cannot take one back, and the mistakes that turn a token into a skeleton key.