Why a server can never trust your browser
14 min readSecurity
Every check you write in the browser can be edited away. Learn where the trust boundary sits and why client-side validation is convenience, not security.
Category
Security
Learn the web security fundamentals every developer should understand, including authentication, password hashing, cookies, sessions, HTTPS, CORS, and common security principles.
Cookies vs Sessions vs Tokens: How websites keep you logged in
11 min readSecurity
You log in once, yet the website keeps knowing who you are. Learn how sessions, cookies and tokens keep you logged in without resending your password.
How user authentication works: the main methods explained
12 min readSecurity
User authentication is how a website proves you are who you claim to be. Learn the methods, from passwords to passkeys and MFA, and the tradeoffs of each.
Why websites can't tell you your password
7 min readSecurity
A well designed website does not know your password, yet it can still check that you typed it right. Learn how password hashing makes that possible.