Security
305 bites tagged Security — interview questions with model answers, and 60-second explainers.
JWT Storage: Cookies (CSRF Risk) vs. Local Storage (XSS Risk)
Storing JWTs means choosing your risk: Cross-Site Request Forgery (CSRF) with cookies, or Cross-Site Scripting (XSS) with local storage. While local storage is simpler, HttpOnly cookies are generally safer as they can't be read by client-side scripts.
CSRF Tokens: Preventing Unwanted State Changes on Your Behalf
CSRF protection prevents a malicious site from forcing a user's browser to submit unwanted requests to your app. It adds a unique token to forms that the server validates. The footgun is failing to protect all state-changing endpoints, not just POST forms.
OAuth 2.0: Delegated Authorization, Not Authentication
Think of OAuth 2.0 as a valet key for your data. It lets a third-party app access specific resources on your behalf without you sharing your password. It's used for "Log in with Google" or letting an app access your photos.
The Refresh Token Pattern: Stay Logged In Securely
A refresh token is like a key to a key-making machine; it mints new access tokens without re-prompting the user. This pattern keeps users logged in to web and mobile apps. The footgun: a leaked refresh token can grant an attacker indefinite access.
Authentication vs. Authorization: Who You Are vs. What You Can Do
Authentication is proving your identity ('Who are you?'), like showing an ID. Authorization is checking your permissions ('What can you do?'), like using a key for a specific door. Systems use both on login. The footgun is treating them as the same concept.
API Rate Limiting: Protecting Your Express Endpoints
Rate limiting acts as a bouncer for your API, preventing any single user from overwhelming it. It's crucial for public APIs and sensitive endpoints like password resets to block abuse. The default in-memory store won't work across multiple server instances.
Helmet.js: Secure Express Apps with HTTP Headers
Helmet.js adds a security layer to Express apps by setting crucial HTTP headers. Use it in any public-facing Node app to prevent common attacks like XSS. The footgun: its default Content-Security-Policy is strict and requires app-specific configuration.
Hashing Data with Node.js's `crypto` Module
Hashing creates a unique, fixed-size fingerprint of data. It's a one-way process used to verify data integrity or store passwords securely without saving the plain text. The footgun is using weak algorithms like MD5 or SHA1 for security-sensitive tasks.
Environment Variables: Config Outside Your Code
Think of a .env file as a Post-it note of secrets for your app, kept separate from your codebase. Use it for API keys or database URLs that change between environments. The biggest mistake is committing your .env file to Git, exposing all your secrets.
Resource Exhaustion: Starving a System to Death
A resource exhaustion attack is a denial-of-service tactic that starves a system by consuming all of a finite resource like CPU or database connections. It exploits missing rate limits or quotas.
Rate Limiting: Your API's Bouncer
Rate limiting acts as a bouncer for your API, controlling traffic to protect your service. It's used on public APIs to prevent abuse, ensure fair usage, and defend against denial-of-service attacks.
Adversarial Attacks: Fooling Smart Models with Tiny Changes
Adversarial attacks trick ML models with tiny, imperceptible input changes, causing misclassification. It's like a visual illusion for an AI, turning a 'stop sign' into a 'speed limit' sign by altering a few pixels.
ML Threat Modeling: Assume Your Data Is Compromised
Threat modeling for ML means assuming your training data is already compromised. This is crucial for services using public or user-supplied datasets. The main footgun is trusting data sources, as data poisoning can silently corrupt your model's behavior.
RBAC for MLOps: Who Can Do What?
RBAC assigns permissions to roles, not people. You create roles like 'Data Scientist' with specific permissions (e.g., access training data), then assign users to that role.
Secrets Management: Beyond Environment Variables
Treat secrets like cattle, not pets: they should be temporary and replaceable. Use a central vault to dynamically inject credentials into apps at runtime, especially in CI/CD and containerized environments.
AI Auditing: The OWASP LLM Top 10 Checklist
Think of an AI audit like a building inspection for your LLM app, checking for structural weaknesses. It uses frameworks like the OWASP Top 10 to find risks like prompt injection and data leakage.
Adversarial Attacks: Tricking LLMs into Misbehaving
Adversarial attacks are inputs designed to trick an LLM, bypassing its safety alignment. This is how "jailbreaks" coax models into generating harmful content. The footgun is assuming safety training makes a model foolproof; it just makes attacks more subtle.
LLM Red Teaming: Adversarial Security Testing
LLM Red Teaming is a simulated attack where you proactively try to break your own AI to find security flaws. It's used to test for vulnerabilities like prompt injection or data leakage, which traditional security tools miss.
macOS App Notarization: Apple's Security Checkpoint
Notarization is an automated security screening for macOS apps. You upload your app, Apple scans it for malware, and issues a ticket to attach to it. This is mandatory for apps distributed outside the Mac App Store.
Keychain Services: A Secure Vault for Small Secrets
Think of Keychain as a system-managed safe deposit box for small secrets like passwords or tokens. It's the go-to for storing API keys or user credentials securely. The main footgun is its clunky C-style API, leading most developers to use a wrapper.
App Sandbox: A Digital Playpen for Your App
The App Sandbox is a digital playpen for your app, restricting it to its own files and resources. It's a core security feature on iOS and macOS, preventing apps from accessing user data or system files without explicit permission.
Fuzz Testing in Rust with cargo-fuzz
Fuzz testing automatically finds bugs by feeding your code pseudo-random inputs. Use `cargo-fuzz` to stress-test parsers and APIs that handle untrusted data. The main footgun is assuming random bytes are enough; effective fuzzing needs structure-aware inputs.
Go Fuzz Testing: Automated Bug Discovery
Go's fuzz testing automatically generates strange inputs to crash your code, finding bugs you'd never think to test. It's ideal for stress-testing parsers or security-sensitive functions.
Regex Engines: Backtracking vs. Finite Automata
A backtracking regex engine tries one path at a time, which can be fast but also exponentially slow. A finite-automata engine (like Go's) checks all paths at once, guaranteeing linear time. The footgun is using a backtracking engine on untrusted user input.
Get Security bites daily.
Five a day, five minutes, offline. With quizzes so it sticks.
Open testing — you’ll join as an early tester.