security
6 minTenant authorization: carry trusted scope into every lookup
Bind resource access to authenticated tenant membership instead of treating object identifiers as permission.
Search the library
13 matching resultsArticles and interview answers
security
5 minSecurity Boundaries: Object Authorization, Input Validation, and Secret Handling
Enforce access on individual resources, keep data separate from executable structure, and prevent sensitive values from crossing logging and build boundaries.
Q&A
Q&AWhy rotate a session identifier after authentication?
Rotation limits session fixation. A session identifies a principal, while each protected operation still requires independent authorization.
Read the concise answer
Rotation limits session fixation. A session identifies a principal, while each protected operation still requires independent authorization.
Q&A
Q&AWhy is a unique resource ID insufficient for tenant authorization?
Identity selects a resource; trusted scope and action policy grant access.
Read the concise answer
Derive tenant context from verified membership, apply it in lookup and mutation predicates, and check the requested action. Cache hits, downloads, and background jobs need the same scope enforcement.
Q&A
Q&AWhat should a client do with a valid 304 response to If-None-Match?
A 304 validates a previously cached representation and does not provide a replacement body. Cache policy and authorization still control whether reuse is appropriate.
Read the concise answer
A 304 validates a previously cached representation and does not provide a replacement body. Cache policy and authorization still control whether reuse is appropriate.
security
5 minAuthentication Foundations: Sessions, Cookies, and Trust Boundaries
Separate identity proof from session continuity and design browser authentication without exposing credentials or trusting client state.
http
5 minHTTP Foundations: Methods, Status Codes, and Representation Boundaries
Design a predictable request and response contract by distinguishing resources, representations, safe methods, and retryable operations.
unix
9 minDNS Troubleshooting: Trace Name Resolution Before Blaming the Network
Separate resolver configuration, caching, search domains, authoritative records, and application-level DNS behavior.