Engineering ArchitectureRead Guide →
Topic · 33 articles
Security
Authentication, authorization, and safe-by-default APIs.
Security is not a feature you add at the end; it is decisions made throughout the stack. This hub covers authentication and session handling, authorization and tenant isolation done server-side, validating untrusted input, and the common API vulnerabilities worth designing against.
It overlaps closely with the NestJS and Node.js hubs, where most of these controls actually get implemented.
All Security articles
Engineering ArchitectureRead Guide →
Engineering ArchitectureRead Guide →
Engineering ArchitectureRead Guide →
Engineering ArchitectureRead Guide →
Engineering ArchitectureRead Guide →
Engineering ArchitectureRead Guide →
Engineering ArchitectureRead Guide →
Engineering ArchitectureRead Guide →
Engineering ArchitectureRead Guide →
Engineering ArchitectureRead Guide →
Engineering ArchitectureRead Guide →
Engineering ArchitectureRead Guide →
Engineering ArchitectureRead Guide →
Engineering ArchitectureRead Guide →
Engineering ArchitectureRead Guide →
Engineering ArchitectureRead Guide →
Engineering ArchitectureRead Guide →
Engineering ArchitectureRead Guide →
Engineering ArchitectureRead Guide →
Engineering ArchitectureRead Guide →
Engineering ArchitectureRead Guide →
Engineering ArchitectureRead Guide →
Engineering ArchitectureRead Guide →
Show all 33 articlesShow fewer
Engineering ArchitectureRead Guide →
Engineering ArchitectureRead Guide →
Engineering ArchitectureRead Guide →
Engineering ArchitectureRead Guide →
Engineering ArchitectureRead Guide →
Engineering ArchitectureRead Guide →
Engineering ArchitectureRead Guide →
Engineering ArchitectureRead Guide →
Engineering ArchitectureRead Guide →
Frequently asked questions
What application security topics are covered here?
Authentication and session handling, authorization and tenant isolation enforced server-side, validating untrusted input, and the common API vulnerabilities worth designing against from the start.
Is authentication the same as authorization?
No. Authentication proves who a user is; authorization decides what that user is allowed to do. Conflating the two is a common source of access-control bugs, and the articles keep the concerns separate.