Application Security

These application security guides are written for backend engineers who ship APIs. Each one covers an attack, a fix and the mistakes that keep it alive.

Start with SQL injection prevention and XSS prevention. Then move to identity with OAuth 2.0 and OIDC. Later posts cover TLS, CORS, WAF rules and DDoS defense, so the set works as a checklist too.

11 articles

15/01/2023 10 min read

JWT Rotation and Revocation: Secure Token Lifecycle in Distributed Systems

JWT Rotation and Revocation keeps distributed APIs safe after a key leak. Learn short lifetimes, key ids, denylists, and refresh reuse detection in production.
28/03/2022 10 min read

DDoS Protection for Backend Systems: Layers, Rate Limiting, and Resilience

DDoS Protection for Backend Systems keeps your API up under traffic floods. Learn edge filters, rate limits, autoscaling…
26/12/2019 9 min read

OAuth 2.0 and OIDC for Backend Engineers: Flows, Tokens, and Common Mistakes

OAuth 2.0 and OIDC explained for backend services. Learn code flow with PKCE, client credentials, token checks, and…
02/10/2019 10 min read

WAF in Modern Backends: Rules, Bypass Risks, and Defense in Depth

WAF in Modern Backends stops bad requests before your app. Learn rule design, false positives, logging, and how…
20/10/2018 10 min read

Encryption at Rest: Key Management, Envelope Encryption, and Compliance

Encryption at Rest protects disks, backups, and columns when storage is copied. Learn envelope keys, KMS control, rotation,…
15/09/2018 10 min read

Encryption in Transit: mTLS, TLS Termination, and Service-to-Service Security

Encryption in Transit protects service calls from network snooping. Learn TLS termination, mTLS, cert rotation, and the gaps…
01/08/2018 10 min read

TLS for Backend Engineers: Handshakes, Certificates, and Production Hardening

TLS for Backend Engineers covers handshakes, certificates, and trust stores. Learn TLS 1.3 settings, rotation, and the failures…
15/01/2018 10 min read

CORS Explained for Backend Engineers: Preflight, Credentials, and Security Pitfalls

CORS Explained for Backend Engineers covers origins, preflight, and credentials. Learn which headers to set, which to avoid,…
20/11/2017 10 min read

CSRF Protection: Tokens, SameSite Cookies, and Modern Browser Defenses

CSRF Protection stops forged state changes from other sites. Learn tokens, SameSite cookies, and where browser defaults still…
15/10/2017 10 min read

SQL Injection Prevention: Parameterized Queries, ORMs, and Defense in Depth

SQL Injection Prevention keeps queries bound to data, not to raw strings. Learn parameters, ORM limits, least privilege,…
01/09/2017 10 min read

XSS Prevention for Backend Engineers: Output Encoding, CSP, and Trust Boundaries

XSS Prevention for Backend Engineers covers encoding, CSP, and trust lines. Learn where output must be escaped and…