Performance & security
Investigate production incidents and protect application boundaries.
Authentication vs authorization vs RBAC?
Authentication checks the caller's identity, authorization decides whether that identity may perform an action, and RBAC groups permissions into roles. These checks work together but answer different questions. A logged-in employee should not automatically gain access to every employee's records.
What makes JWT or session authentication safe?
Token and session security means accepting only credentials issued by a trusted authority for the intended purpose and lifetime. A JWT can carry verifiable claims, while a server session uses stored state behind a session identifier. Both need secure transport, controlled storage, expiry and a response to credential theft.
How should I store passwords and secrets?
Password hashing turns a password into a one-way verification value using an intentionally expensive algorithm. Secret management protects credentials that the application must be able to use again, such as database passwords or API keys. Passwords should not be reversibly encrypted just so they can be compared at login.
XSS vs CSRF vs CORS?
XSS, CSRF and CORS concern browser trust but refer to different mechanisms. XSS runs attacker-controlled script in a trusted page, CSRF triggers requests with automatically attached credentials, and CORS controls whether browser code may read cross-origin responses. A defense for one does not automatically solve the others.
How do I prevent SQL injection, NoSQL injection and SSRF?
Injection occurs when untrusted data becomes part of a command's structure rather than remaining data. SSRF occurs when the server's network access is used to reach an unintended destination. These attacks bypass simple “is this input present?” checks because apparently valid strings or objects can still cause unauthorized behavior.
What are least privilege, TLS and secure headers?
Least privilege limits what a user or service can access, TLS protects data while it travels, and secure headers constrain some browser behaviors. Encryption at rest protects stored data under the storage threat model, but does not prevent an authorized application from exposing it. Security works through several focused controls rather than one universal setting.
Is rate limiting enough to prevent every attack?
Rate limiting restricts how much work a caller can request within a defined policy. It protects capacity and makes repeated abuse harder, but it cannot distinguish every attacker or stop all traffic before it reaches the system. Rules should fit the resource, user identity and infrastructure layer.
Difficulty is an editorial estimate. Completion means you chose to mark a question as understood.