Core jargon for software architecture, delivery, and engineering culture.
The process of verifying that someone is who they claim to be.
Deciding what an already-authenticated user is allowed to do or see.
An attack that tricks a logged-in user's browser into making an unwanted request to your app — exploiting the fact that browsers automatically attach cookies to requests.
HTTP over TLS — the transport layer is encrypted so credentials and data can't be read or tampered with in transit.
A signed, self-contained token that encodes claims (user ID, roles, expiry) as base64 JSON — the server can verify it without hitting the database.
An attack where unsanitized user input gets interpreted as SQL, letting an attacker read, modify, or delete data they shouldn't touch.
An attack where malicious scripts get injected into a page and run in other users' browsers — usually by storing attacker-controlled input that the app then renders as HTML.