Security
Password Storage: bcrypt, scrypt, Argon2, and Why Plain Hashing Fails
Why fast general-purpose hashes like SHA-256 are unsafe for passwords, and how bcrypt, scrypt, and Argon2 defend against modern offline cracking hardware.
3 min read
Tag
Authentication
4 articles
Security
OAuth 2.0 and OpenID Connect: Flows Explained for App Developers
A practical guide to OAuth 2.0 and OpenID Connect flows for application developers, covering authorization code with PKCE and why implicit flow is obsolete.
3 min read
Security
JWT Security Pitfalls and Hardening
JSON Web Tokens are easy to misuse in ways that look correct in a demo and fail catastrophically in production — a walkthrough of the common mistakes.
3 min read
Security
CSRF: When You Still Need to Care
SameSite cookies made CSRF less of a default threat, but the attack is far from dead for APIs using cookie auth, subdomains, or older browsers.
3 min read