Tagged Security
9 articles tagged Security.
Backend & Databases4 min readQR Phishing Rose 146% in One Quarter. What to Check Before You Scan
A QR code hides its destination by design. How quishing bypasses email filters, and how to inspect a code before it reaches a browser.
The TweakPad Team
- Web Development7 min read
HTML Escaping Is Not XSS Protection. Context Is.
Five entities are enough in an HTML body and useless inside a script tag or an href. What each context actually needs.
The TweakPad Team
- JavaScript6 min read
Math.random Is Predictable. Where That Actually Matters
V8 runs xorshift128+ with 128 bits of state an attacker can recover from a few outputs. When to reach for crypto instead.
The TweakPad Team
- Backend & Databases11 min read
Decoding a JWT Is Not Verifying It
A JWT decoder reads the payload without the key, because the payload is only Base64. What proves a token is real, and what does not.
The TweakPad Team
- Backend & Databases5 min read
Why SHA-256 Is the Wrong Way to Hash a Password
SHA-256 is fast, and speed is the attacker advantage. What to use instead, the OWASP parameters, and the bcrypt limit that truncates.
The TweakPad Team
- Data Formats4 min read
Base64 Is Not Encryption, and Three Other Things It Is Not
What Base64 actually does, why it makes files bigger, why btoa breaks on emoji, and when base64url is the one you need instead.
The TweakPad Team
- Backend & Databases5 min read
The Regex That Works Fine Until One Input Hangs Your Server
Catastrophic backtracking turns a working pattern into a CPU bomb. Why nested quantifiers explode, and how to spot and rewrite them.
The TweakPad Team
- Backend & Databases4 min read
API Authentication: Sessions, JWTs, API Keys and OAuth Compared
Session cookies, JWTs, API keys and OAuth compared — including why stateless JWTs make logout hard, and what to do about it.
The TweakPad Team
- Next.js2 min read
Next.js Server Actions: Forms, Validation and Security
How Server Actions work, why they are safer than an API route for form handling, and the validation and authorisation you must not skip.
The TweakPad Team