Security Basic

This section currently has 7 articles, each built around a mechanism that is often believed to protect more than it does: logging in is not authorization, blocking the read of a response is not blocking the request, validating a URL string is not controlling the connection target.

Scope (read first)

Covered: object-level authorization (BOLA/IDOR), CORS and CSRF, SSRF, session cookies and JWT, password hashing, OAuth 2.0/OIDC with PKCE, and secure coding (SQL injection, secrets, logging, passwords, path traversal, prototype pollution, ReDoS).

Not covered yet: MFA, XSS, in-depth logging/audit. Rate limiting lives in the API group: Rate limiting for APIs. Don’t treat this section as a complete security checklist; it is a set of specific pieces, each going deep enough to be verifiable.

Reading path

Order	Article	Level	You will be able to answer
1	BOLA/IDOR	basic	Why can a valid token still read someone else’s order? How do you write a scoped query? How does BOLA differ from BFLA and BOPLA? What do list, bulk and nested endpoints need to check?
2	CORS and CSRF	intermediate	Which requests get a preflight? What does SameSite=Lax block and what does it let through? Why does CORS not prevent CSRF? How do you use tokens, Origin and Sec-Fetch-Site?
3	SSRF	intermediate	Why is blocking localhost not enough? What are the metadata endpoint and IMDSv2? How do redirects and DNS rebinding bypass checks, and what does a safe fetch look like?
4	Session cookie or JWT	intermediate	Session or JWT, depending on which revocation needs? Which attributes does the cookie need? What must JWT verification check? How does refresh token rotation detect a stolen token?
5	Secure coding	intermediate	Which vulnerabilities live right in the code: SQL injection (including ORDER BY), mass assignment, secrets and logs, password hashing, path traversal, prototype pollution, ReDoS?
6	Password hashing	intermediate	Why does salted SHA-256 still break? Which of argon2id, scrypt, bcrypt or PBKDF2, with which parameters? How do you upgrade old hashes?
7	OAuth 2.0, OIDC and PKCE	intermediate	Why Authorization Code + PKCE and not implicit or the password grant? Where should tokens live in an SPA? What must the API check on an access token?

Article 1 is the foundation (authorization); articles 2 and 3 are independent of each other, so read them as needed. Read article 4 after article 2 because it builds on cookies, SameSite and CSRF.

If you see this symptom, read this article

Symptom or question	Article
A user changes the ID in the URL and sees other people’s data	BOLA/IDOR
A regular user can send an extra role field or call an admin route	BOLA/IDOR (the BOPLA/BFLA section)
An email or account setting changed after the user opened an unfamiliar page	CORS and CSRF
A “blocked by CORS policy” error, or you want to open an API to another domain	CORS and CSRF
There is an “enter a URL” endpoint (avatar, preview, webhook)	SSRF
Logs show requests from the server to 127.0.0.1, private IPs or 169.254.169.254	SSRF

Related

Webhooks and idempotency covers the server-to-server side of the same kind of confusion: verifying a signature is different from preventing duplicate processing.