One search. Connected ideas.

JWT is a token format, not a role: an access token can be a JWT or another format. An access token authorizes calls to an API, while a refresh token is used with the identity service to obtain new access tokens. Separating these roles limits how long a stolen access token is useful and supports longer login sessions.

OAuth is a framework for delegated access, allowing a client to act with limited permission on protected resources. OpenID Connect (OIDC) adds a standard identity layer for user login on top of OAuth. The authorization code flow separates browser redirects from the token exchange and commonly uses PKCE to protect that exchange.

Injection, XSS, CSRF and SSRF attack different trust boundaries. Injection changes a database command, XSS runs unwanted browser code, CSRF abuses automatically attached credentials, and SSRF makes a server contact an unintended destination. Input validation helps, but each attack also needs controls at the point where the dangerous action happens.

A cookie is a small piece of browser-managed data sent automatically with matching requests. A server-side session uses an unpredictable identifier, often in a cookie, to look up login state on the server. This lets the server revoke or change that state without placing all session details in the browser.

JWT is a token format, not a role: an access token can be a JWT or another format. An access token authorizes calls to an API, while a refresh token is used with the identity service to obtain new access tokens. Separating these roles limits how long a stolen access token is useful and supports longer login sessions.

OAuth is a framework for delegated access, allowing a client to act with limited permission on protected resources. OpenID Connect (OIDC) adds a standard identity layer for user login on top of OAuth. The authorization code flow separates browser redirects from the token exchange and commonly uses PKCE to protect that exchange.

Injection, XSS, CSRF and SSRF attack different trust boundaries. Injection changes a database command, XSS runs unwanted browser code, CSRF abuses automatically attached credentials, and SSRF makes a server contact an unintended destination. Input validation helps, but each attack also needs controls at the point where the dangerous action happens.

A cookie is a small piece of browser-managed data sent automatically with matching requests. A server-side session uses an unpredictable identifier, often in a cookie, to look up login state on the server. This lets the server revoke or change that state without placing all session details in the browser.

Node.js learning module

Node.js learning module