Security
Input validation
Validation constrains data shape, ranges, and allowed values.
REFERENCE CATEGORY
Security
19 practical topics
Security
SQL injection
Injection happens when input changes SQL structure instead of remaining data.
Security
Cross-site scripting (XSS)
XSS lets attacker-controlled text execute as script in a browser.
Security
Cross-site request forgery (CSRF)
CSRF exploits browser credentials on unwanted cross-site mutations.
Security
Authentication versus authorization
Authentication identifies the actor; authorization determines permitted actions.
Security
Authentication
Secure authentication verifies credentials and manages sessions safely.
Security
Authorization and RBAC
RBAC assigns capabilities via roles, combined with resource scope.
Security
Password hashing
Password hashes allow verification without storing plaintext.
Security
Sessions
Sessions associate a browser with authenticated server-side state.
Security
Rate limiting
Rate limits bound abusive request frequency.
Security
Mass assignment
Mass assignment writes many model attributes from an array.
Security
Secure headers
Response headers can reduce browser-side exposure.
Security
Secrets management
Secrets include credentials, tokens, and encryption keys.
Security
Logging
Security logs record relevant events without unnecessary sensitive data.
Security
Audit trails
Audit records document who did what, when, and to which entity.
Security
Least privilege
Least privilege grants only the access necessary for a task.
Security
Secure error handling
Safe errors reveal useful client information without internal details.
Security
File upload security
Uploads introduce untrusted bytes, names, and storage paths.
Security
ISO/IEC 27001 context
ISO/IEC 27001 concerns an organizational information security management system.