23
Systems + delivery / Intermediate → advanced
Application security essentials
Authentication, authorization, password hashing, MFA, CSRF, XSS, CSP, rate limiting, secrets, uploads, and secure production defaults.
01Authentication vs authorization
Authentication establishes who a user is. Authorization decides what that authenticated user may do. Every sensitive route must enforce authorization server-side; hiding a button in the UI is not authorization.
02Common web controls
- Use modern password hashing such as scrypt/Argon2/bcrypt with appropriate parameters.
- Require secure, HttpOnly, SameSite cookies in HTTPS production.
- Use CSRF tokens for cookie-authenticated state-changing forms.
- Escape untrusted output and avoid unsafe HTML injection.
- Use CSP as defense in depth.
- Rate-limit login and abuse-prone endpoints.
- Rotate/revoke credentials after exposure.
03File upload security
Do not trust the filename or Content-Type alone. Impose size limits, decode/validate supported formats, generate server-side storage names, prevent path traversal, and use durable storage with controlled delivery URLs.