// Learning · 09

Security

Who may do what, and how to keep secrets and data out of the wrong hands.

Review 10 flashcards→

1.Authentication vs Authorization
Who are you? (401)leads totwo checksWhat may you do? (403)
Authentication says who you are; authorization says what you may do.
Open the diagram→
- Client uses / calls Orders API (1 GET /orders/42)
- Orders API fails / error path HTTP 401 (2 no valid token)
- Orders API uses / calls Orders table (3 load order)
- Orders API fails / error path HTTP 403 (4 not your order)
2.OAuth 2.0 & OpenID Connect
User logs inleads toone-time codeAuth code + PKCEleads toTokens for API
Delegated sign-in: the app gets a token for an API, not the password.
Open the diagram→
- Browser uses / calls Identity provider (1 authorize+PKCE)
- Identity provider publishes / notifies Browser (2 redirect+code)
- Browser uses / calls Client app (3 code to app)
- Client app uses / calls Identity provider (4 code+verifier)
- Identity provider creates Client app (5 ID + access)
- Client app uses / calls Orders API (6 Bearer token)
3.JSON Web Tokens
Login succeedsleads toBearer headerSigned tokenleads toAPI verifies it
Signed, self-contained claims the server can verify without a lookup.
Open the diagram→
- Identity provider creates Client app (1 issue JWT)
- Client app uses / calls Orders API (2 Bearer token)
- Forged token fails / error path Orders API (3 rejected 401)
4.Least Privilege
Broad admin rightsleads toScoped roleleads toOnly what is needed
Grant each identity only the permissions its job needs, and no more.
Open the diagram→
- Orders service uses / calls Orders schema (1 SELECT, INSERT)
- Billing service uses / calls Payments schema (2 SELECT only)
- Orders service fails / error path Blocked: DROP TABLE (3 DROP TABLE)
- Orders service fails / error path Payments schema (4 no grant)
5.Injection
Untrusted inputleads toConcatenatedleads toParsed as SQL
Untrusted text is read as code; keep data and code apart.
Open the diagram→
- Attacker input fails / error path Orders API (1 crafted input)
- Orders API creates Built SQL (2 build string)
- Built SQL uses / calls Orders database (3 runs as code)
6.Secrets Management
Password in gitleads tofetch at startVault lookupleads toRotated, scoped secret
Secrets live in a vault or an identity, never in code, config or logs.
Open the diagram→
- Orders service uses / calls Key vault (1 identity auth)
- Orders service uses / calls Orders database (2 connect)
- Key vault replicates / copies Orders database (3 rotate login)
- Secret scanner fails / error path Committed secret (4 push blocked)
7.CORS
Other site's scriptleads toBrowser checksleads toResponse hidden
Tells the browser which other websites may read your API responses.
Open the diagram→
- Shop page uses / calls Orders API (1 preflight)
- Orders API publishes / notifies Shop page (2 allow origin)
- Shop page uses / calls Orders API (3 real request)
- Other site fails / error path Orders API (4 read blocked)
8.Cross-Site Request Forgery
Victim browserleads toauto cookieAuto-sent cookieleads toUnwanted change
Another site makes your browser submit a request as you.
Open the diagram→
- Logged-in browser uses / calls Attacker page (1 visits page)
- Attacker page fails / error path Bank site (2 forged POST)
- Bank site fails / error path Rejected request (3 no valid token)
9.Encryption in Transit and at Rest
Plaintext on the wireleads toenvelope keysTLS 1.2+leads toEncrypted at rest
Encrypt data on the wire with TLS and on disk with managed keys.
Open the diagram→
- Browser uses / calls Orders API (1 TLS handshake)
- Orders API uses / calls Payments service (2 mTLS call)
- Orders API creates Orders database (3 PII envelope)
- Orders API uses / calls Key management (KMS) (4 wrap data key)
- Network sniffer fails / error path Orders API (sees ciphertext)
10.Zero Trust
Trust the networkleads toVerify each requestleads toLeast access, always
No implicit trust from the network; verify every request.
Open the diagram→
- Remote user uses / calls Policy enforcement (1 HTTPS + token)
- Policy enforcement uses / calls Policy engine (2 ask: allowed?)
- Policy enforcement uses / calls Orders service (3 allowed call)
- Lateral attacker fails / error path Orders service (4 no identity)

1.Authentication vs Authorization

2.OAuth 2.0 & OpenID Connect

3.JSON Web Tokens

4.Least Privilege

5.Injection

6.Secrets Management

7.CORS

8.Cross-Site Request Forgery

9.Encryption in Transit and at Rest

10.Zero Trust