Security
Part of the Interview Prep Roadmap. Coverage ratings are explained there.
Authentication and authorization basics, then common vulnerabilities and how to defend against them.
Coverage: thin
Resources · OWASP Top Ten — the canonical vulnerability list
Authentication & Authorization
- Authentication vs. authorization
- Sessions, cookies, and tokens
- OAuth and single sign-on
- Password storage: hashing and salting
Practice
- Authentication vs. authorization — DSI
- Cookie-based auth, and blacklisting a cookie — Exabyting, with answer
- The structure of a JWT — Exabyting, with answer
- Parts of a JWT token — WSD
- Auth across microservices — Priyo
- Walk through auth in your own project — Chaldal
Common Vulnerabilities
- SQL injection
- Cross-site scripting
- Cross-site request forgery
- Insecure direct object references
Secure Communication
- Symmetric vs. asymmetric encryption
- TLS/SSL and certificates
- Hashing vs. encryption
Practice
- Symmetric vs. asymmetric encryption — National University
- Encrypting large volumes of data — Green University
- What a digital signature is — National University
- What runs under the hood in HTTPS — Exabyting, with answer
Defensive Practices
- Input validation and sanitization
- Principle of least privilege
- Secret management
Practice