Chisato · · 5 min read What Is Session Fixation?
Session fixation tricks a victim into using an attacker-known session ID, so logging in hands the attacker an authenticated session too.
#Security
#Authentication
#Web Development
Topic
#Authentication
23 posts tagged “Authentication”.
Chisato · · 5 min read 
Chisato · · 4 min read What Is IDOR? Insecure Direct Object References Explained
IDOR is an access control flaw where an app trusts a user-supplied ID to fetch a record without checking the requester actually owns it.
#Security
#Web Development
#Authentication
Chisato · · 4 min read What Is a Replay Attack?
A replay attack resends a captured, valid message to trick a system into repeating an action — and why timestamps, nonces, and signatures stop it.
#Security
#Authentication
#Networking
Chisato · · 4 min read The OAuth PKCE Flow Explained
PKCE hardens the OAuth authorization code flow against interception, and is now recommended for every client type, not just mobile and single-page apps.
#Security
#Authentication
#Web Development
The Lycoris Team · · 4 min read API Keys vs OAuth Tokens: What's the Difference
API keys are static secrets tied to an app; OAuth tokens are short-lived, scoped, and tied to a specific user's consent. Here's when to use each.
#Security
#APIs
#Authentication
Chisato · · 4 min read Cookie Attributes Explained: HttpOnly, Secure, SameSite
HttpOnly, Secure, and SameSite are cookie attributes that block script access, force HTTPS, and limit cross-site sending. Here's what each one actually stops.
#Security
#Web Development
#Authentication
Chisato · · 5 min read RBAC vs ABAC: Access Control Models Explained
RBAC grants access based on a user's assigned role; ABAC evaluates attributes of the user, resource, and context at request time. How they compare.
#Security
#Authentication
#Web Development
The Lycoris Team · · 5 min read How Digital Signatures Work
A digital signature uses a private key to prove a message's origin and integrity, and a public key lets anyone verify it — no shared secret required.
#Security
#Cryptography
#Authentication
Chisato · · 4 min read What Is Credential Stuffing? Attacks and Defenses Explained
Credential stuffing tests stolen username-password pairs against other sites, exploiting reused passwords. How it works and the defenses that actually stop it.
#Security
#Authentication
#Web Development
Chisato · · 4 min read What Is a TPM? Trusted Platform Module Explained
A TPM is a dedicated chip that generates and stores cryptographic keys in hardware, isolated from the operating system. Here's what it actually does.
#Security
#Hardware
#Authentication
Chisato · · 5 min read What Is SSO? Single Sign-On Explained
SSO lets a user log in once with one identity provider and access multiple apps without re-entering credentials. How the trust relationship works.
#Security
#Authentication
#Web Development
Chisato · · 4 min read What Is HMAC? Message Authentication Explained
HMAC combines a secret key with a hash function to prove a message wasn't altered and came from someone who holds the key. Here's how it works.
#Security
#Cryptography
#Authentication
Chisato · · 4 min read Password Hashing Explained: Salting, Bcrypt, and Argon2
Password hashing turns a password into a one-way, salted digest so a stolen database doesn't hand over credentials. How bcrypt and Argon2 work.
#Security
#Authentication
#Web Development
Chisato · · 4 min read What Is mTLS? Mutual TLS Authentication Explained
mTLS is TLS where both client and server present certificates, so each side cryptographically proves its identity before any data is exchanged.
#Security
#Networking
#Authentication
Chisato · · 4 min read What Is Multi-Factor Authentication (MFA)?
MFA requires two or more independent proofs of identity — something you know, have, or are — to stop stolen passwords from being enough to break in.
#Security
#Authentication
#Web Development
Chisato · · 4 min read What Is CSRF? Cross-Site Request Forgery Explained
CSRF tricks a logged-in user's browser into sending an unwanted authenticated request. Cookies, tokens, and SameSite settings are the defense.
#Security
#Web Development
#Authentication
Chisato · · 5 min read Hashing vs Encryption: What's the Difference?
Hashing is one-way and encryption is reversible — they solve different problems. When to use each, why passwords are hashed, and common mistakes.
#Security
#Encryption
#Authentication
Chisato · · 6 min read What Is Zero Trust Security? Never Trust, Always Verify
Zero trust security treats every user, device, and request as untrusted until verified. Core principles, ZTNA vs VPN, and a practical adoption path.
#Security
#Authentication
#Networking
Chisato · · 4 min read OAuth vs OIDC vs SAML: What's the Difference?
OAuth 2.0 handles authorization, OIDC adds authentication, and SAML powers enterprise SSO. How the three protocols differ and which one your app needs.
#Security
#Authentication
#Web Development
Chisato · · 5 min read OAuth 2.0 Grant Types: Which Flow Should You Use?
OAuth 2.0 grant types are the flows apps use to get access tokens. Authorization code with PKCE, client credentials, device flow — and when to use each.
#Security
#Authentication
#Web Development
Chisato · · 6 min read What Is OAuth? How OAuth 2.0 Works, Explained
OAuth 2.0 lets apps access your data without your password. How the authorization flow works, what PKCE adds, and how OAuth differs from authentication.
#Security
#Authentication
#Web Development
Chisato · · 4 min read What Is a JWT? JSON Web Tokens, Explained
A JWT is a compact, signed token that carries JSON claims — identity and authorization without a session lookup. How it works and what to watch out for.
#Security
#Authentication
#Web Development
Chisato · · 6 min read Why Passkeys Are Replacing Passwords
Passkeys are phishing-resistant, faster to use, and now supported almost everywhere. Here's how they work and why the password era is finally ending.
#Security
#Authentication
#Privacy