OAuth 2.0 Fundamentals
OAuth 2.0 as scoped token-based access between clients, users, and resource servers.
Security
Authentication, authorisation, encryption, abuse prevention, and defence-in-depth patterns for protecting systems, data, and trust boundaries.
JSON Web Tokens (JWTs) Explained
JWTs as signed tokens with a header, payload, and verifiable signature.
Sessions, Cookies, JWTs, Tokens, SSO, and OAuth 2.0
Sessions, cookies, JWTs, SSO, and OAuth 2.0 mapped to identity and access flows.
HTTPS Handshake and Trust Model
HTTPS handshakes, certificate checks, and encrypted HTTP over TLS.
Single Sign-On (SSO)
Single sign-on through shared authentication, trust, and application sessions.
Network Security Cheat Sheet
Network security controls and common threats mapped across OSI layers.
OAuth 2.0 Flows
OAuth 2.0 flows for public clients, confidential clients, devices, and delegated access.
HTTP Cookies
HTTP cookies store browser state and return it on matching later requests.
TOTP Authenticator Architecture
TOTP authenticators through shared secrets, time windows, and code validation.
VPN Architecture and Tunneling
VPN tunnelling through encrypted links, route changes, and trust boundaries.
SSH Session Establishment
SSH sessions through key exchange, host verification, and encrypted channels.
Cookies vs Sessions vs JWT vs PASETO
Cookies, sessions, JWT, and PASETO compared by state, transport, and revocation.
HTTPS Security Model
HTTPS safety through TLS trust, endpoint security, and controlled interception.
JWTs and Stateless Authentication
JWTs through signed claims, local verification, and stateless session design.
Session-Based Authentication vs. JWTs
Session and JWT authentication compared by state storage and validation flow.
Symmetric vs. Asymmetric Encryption
Symmetric and asymmetric encryption compared by key model, speed, and usage.
HTTPS and TLS Handshakes
TLS handshakes through certificates, key exchange, and session encryption.
Sensitive Data Management in Systems
Sensitive data handling through minimisation, segregation, encryption, and audit.
How Digital Signatures Work
Digital signatures combine hashing, private-key signing, and public verification.
4 Authentication Mechanisms
Authentication mechanisms for password checks, session state, delegated access, and MFA.
6 Firewall Use Cases
Firewall policies for ports, addresses, applications, segmentation, and attack filtering.
Secure System Design
Secure system design through trust boundaries, least privilege, and layered controls.
Tokens, Cookies, and Sessions
Tokens, cookies, and sessions as separate parts of a web authentication flow.
HTTP Cookies
HTTP cookies through browser storage, scoping rules, and session continuity.
Cookies vs. Sessions
Cookies and sessions compared by client storage and server-side state.
How Firewalls Work
Firewalls enforce network policy through packet, stateful, and application checks.
Passkeys and Passwordless Authentication
Passkeys through public-key login, phishing resistance, and device trust.
Password Manager Architecture
Password managers through local encryption, key derivation, and encrypted sync.
Permission System Design
Permission system models including ACL, RBAC, ABAC, DAC, and MAC.
Secure Password Storage
Password storage with slow hashes, per-user salts, and careful verification.
Encoding, Encryption, and Tokenization
Encoding, encryption, and tokenization compared by representation and exposure.
DevSecOps
DevSecOps embeds security checks and controls throughout software delivery.