Web Security
Security reads as intimidating until you see how each attack actually works. These articles walk through the common ones — what the attacker sends, why the naive code accepts it, and the specific change that closes the hole.
Common attacks
- OWASP Top 10 Explained: Ten Categories, Ten Fixes Most people memorise the ten names and still ship broken access control. The list names categories of failure, not specific bugs, and that gap is where projects get hit. Tutorial · 12 min read · August 6, 2026
- SQL Injection Explained: The Fix Is Not Escaping Quotes Two dashes typed into a login box can delete the password check from your own query. The fix is not smarter escaping, and most beginners reach for escaping first. Tutorial · 12 min read · August 6, 2026
- XSS Explained: Why innerHTML Is a Security Bug Paste a script tag into innerHTML and nothing happens, so people conclude it is safe. An img tag with an onerror handler tells a very different story. Tutorial · 12 min read · August 6, 2026
- CSRF Explained: Why Your Own Cookie Attacks You The attacker never reads a single byte of the response, and the transfer still goes through. That is the part people misjudge about CSRF. Tutorial · 12 min read · August 6, 2026
Identity and secrets
- Password Hashing Explained: Why SHA-256 Is Wrong Here SHA-256 is a good hash. That is exactly the problem: it is fast, and speed is the one property you do not want when someone is guessing your users' passwords. Tutorial · 12 min read · August 6, 2026
- SSH Permission Denied (publickey): Fixing Git Auth The server did not reject your password. It never asked for one. Understanding that single sentence is most of the fix. Tutorial · 12 min read · August 6, 2026
- JWT Authentication Explained (and Where It Goes Wrong) A JWT is signed, not encrypted. Anyone holding one can read it — and confusing verify with decode is a complete authentication bypass. Tutorial · 11 min read · August 5, 2026
- Cookies vs Sessions vs Tokens: What Is the Difference? These three get compared as if they were competing options. They are not — a cookie is a delivery mechanism, and it can carry either of the other two. Comparison · 10 min read · August 5, 2026
Transport and headers
- HTTPS and TLS Explained: What the Padlock Really Means The padlock does not mean the site is safe. It means the connection is private with whoever controls that domain, and a phishing site can get one for free in minutes. Tutorial · 12 min read · August 6, 2026
- What Is CORS and How to Fix the Error The request worked in Postman and fails in the browser. Nothing is broken — you are meeting a rule that only browsers enforce. Tutorial · 10 min read · August 5, 2026
More on Web Security
- localStorage vs sessionStorage: What Actually Differs You save a user object, read it back, and get the string [object Object]. Web Storage stores nothing but strings, and that one fact explains most of the bugs people hit with it. Comparison · 11 min read · August 6, 2026
- Environment Variables Explained: Config Without Secrets in Code The first real security lesson most developers learn, usually the hard way — after committing an API key to a public repository. Tutorial · 10 min read · August 6, 2026