API Design Jul 26, 2026 8 min read
Preventing Sensitive Data from Being Cached
Protect authenticated and personalized API responses from browser and shared-cache leaks with safe Java and Node.js policies and tests.
Tag
Authentication
23 articles with this tag. Follow these related notes when you want a narrower study path.
Security Jul 25, 2026 7 min read
API Request Signing Explained
Design HMAC API request signing in Java and Node.js with canonical requests, timestamps, nonces, replay defense, rotation, tests, and failure handling.
Authentication Jul 25, 2026 7 min read
OAuth Authorization Code Flow Explained
Implement OAuth Authorization Code with PKCE safely in Spring Security and Node.js, including state, callbacks, token exchange, tests, and mistakes.
Authentication Jul 25, 2026 7 min read
Password Reset Token Best Practices
Build secure single-use password reset tokens in Spring Boot and Node.js with random generation, hash storage, expiry, rate limits, tests, and auditing.
Backend Jul 2, 2026 6 min read
API Authentication Best Practices
Learn API authentication best practices, including tokens, API keys, OAuth, mTLS, sessions, gateways, rotation, scopes, errors, and logging.
Backend Jul 2, 2026 5 min read
Cookie Security Checklist
Use this backend cookie security checklist for HttpOnly, Secure, SameSite, CSRF, session rotation, prefixes, expiration, domains, and testing.
Backend Jul 2, 2026 6 min read
Cookie vs Token Authentication
Compare cookie and token authentication for backend apps, including sessions, JWTs, CSRF, XSS, storage, CORS, mobile clients, and API tradeoffs.
Backend Jul 2, 2026 5 min read
OAuth Client Credentials Flow Explained
Learn the OAuth client credentials flow for service-to-service APIs, including clients, secrets, scopes, tokens, rotation, and security risks.
Backend Jul 2, 2026 4 min read
OAuth Scopes Explained
Learn OAuth scopes for backend APIs, including permissions, consent, least privilege, access tokens, naming, validation, and common mistakes.
Backend Jul 2, 2026 5 min read
Service Accounts Explained
Learn service accounts for backend systems, including machine identity, API access, least privilege, secrets, rotation, audit logs, and risks.
Backend Jun 30, 2026 5 min read
API Key vs OAuth Token: Practical Backend Differences
Compare API keys and OAuth tokens for backend APIs, including identity, scopes, rotation, expiration, user context, service access, and security tradeoffs.
Backend Jun 30, 2026 5 min read
MFA Explained for Web Apps
Learn how multi-factor authentication works in web apps, including TOTP, WebAuthn, backup codes, recovery flows, step-up checks, and backend tradeoffs.
Backend Jun 30, 2026 5 min read
Password Hashing Explained for Backend Developers
Learn password hashing basics for backend systems, including salts, slow hashes, peppers, verification, resets, storage risks, and common mistakes.
Backend Jun 30, 2026 5 min read
Refresh Token Rotation Explained for Backend Developers
Learn how refresh token rotation works, why reuse detection matters, and how backend teams can design safer token refresh, logout, and revocation flows.
Backend Jun 30, 2026 5 min read
SameSite Cookies Explained for Backend Developers
Learn how SameSite cookies affect browser authentication, CSRF risk, cross-site requests, OAuth redirects, iframes, and backend cookie design.
Backend Jun 30, 2026 4 min read
Session Fixation Explained for Backend Developers
Learn what session fixation is, how it affects web authentication, why session rotation matters, and how backend teams can prevent it.
Backend Jun 29, 2026 4 min read
Authorization vs Authentication
Compare authentication and authorization in backend systems, including identity checks, permissions, roles, scopes, sessions, tokens, and API enforcement.
Backend Jun 29, 2026 4 min read
JWT Claims Explained
Learn common JWT claims for backend authentication, including sub, iss, aud, exp, nbf, iat, jti, scopes, roles, tenant context, and validation mistakes.
Backend Jun 29, 2026 5 min read
OAuth 2.0 vs OpenID Connect
Compare OAuth 2.0 and OpenID Connect for backend developers, including authorization, login, ID tokens, access tokens, scopes, and common mistakes.
Backend May 3, 2026 7 min read
CSRF vs XSS: Key Differences for Backend Developers
Compare CSRF and XSS attacks for backend developers, including how they work, why cookies and tokens matter, and practical defenses.
Backend Apr 19, 2026 6 min read
OAuth 2.0 Explained for Backend Developers
A backend-focused OAuth 2.0 guide covering roles, authorization code flow, PKCE, scopes, tokens, client credentials, and common mistakes.
Backend Apr 12, 2026 6 min read
Access Token vs Refresh Token
Compare access tokens and refresh tokens in backend authentication, including lifetime, storage, rotation, revocation, and security tradeoffs.
Backend Jan 28, 2026 5 min read
JWT vs Session Authentication: Practical Backend Tradeoffs
Understand JWT and server-side session authentication, including storage, revocation, scaling, security risks, and common backend use cases.