Guides tagged “Security”
Reviewed developer guides with worked examples, limitations and links to the standards or documentation behind the tools.
CHMOD 755 vs 644 vs 600: Permissions Explained with ExamplesDecode common Unix permission modes, see why files and directories need different execute bits, and avoid insecure recursive chmod fixes.JWT Decoding vs Verification: The Difference That Prevents Security BugsDecoding a JWT only reveals its claims. Verification proves whether the token can be trusted. See the distinction with safe examples and production checks.JWT Claims Explained: exp, iat, nbf, iss, aud and subA practical reference for common JWT registered claims, with clock-skew notes, validation rules and examples that separate inspection from trust.CORS Preflight Requests Explained with Real OPTIONS ExamplesUnderstand when browsers send an OPTIONS preflight, what headers they ask for, and how a server should answer without weakening cross-origin policy.Why Access-Control-Allow-Origin: * Fails with CredentialsWhy wildcard origins and credentialed browser requests do not mix, what to return instead, and how to avoid reflecting untrusted origins.HTTP Security Headers: What Each Header Actually DoesA practical map of HSTS, CSP, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and legacy frame protections, with deployment caveats.Content-Security-Policy Explained: Start with a Safe BaselineBuild a CSP from default-src, script-src, object-src, base-uri and frame-ancestors, then tighten it with reporting instead of copying a header blindly.