Web Security

Authentication verifies WHO you are — login/password, biometrics, a token. Authorization decides WHAT that already-verified identity may do — its permissions on actions and resources. Authentication runs first; authorization follows.

XSS is an injection flaw where attacker-supplied input is rendered unescaped into a page, so the browser runs it as HTML/JS. A comment with <script> then executes for every viewer, letting the attacker steal cookies or rewrite the page.

Cookies are small key-value data a site stores in the browser via Set-Cookie; the browser sends them back on each request to that origin, enabling sessions or preferences over stateless HTTP. JS reads non-HttpOnly ones.

Set HttpOnly so JS can't read it (blunting XSS theft), Secure so it travels only over HTTPS, and SameSite to curb cross-site sending. Keep lifetimes short and sign the cookie (e.g. HMAC) so the server detects tampering.

A JSON Web Token — a compact header.payload.signature string, base64url-encoded, carrying claims, usually for stateless auth. It's SIGNED (HMAC/RSA) for integrity but NOT encrypted, so anyone holding it can read the payload.

The payload is only base64url-encoded, not encrypted — never put secrets in it. Verify the signature and pin the expected alg to avoid alg:none and HMAC/RSA confusion. Tokens can't be revoked before expiry without extra state.

Escape/encode untrusted data for its output context (HTML, attribute, JS, URL), sanitize allowed HTML with a vetted library, set a Content-Security-Policy to limit scripts, and mark cookies HttpOnly. Never concatenate raw input.