Security & Authentication
4 guidesTrust boundaries, sessions, authentication, and authorization.
Authentication Foundations: Sessions, Cookies, and Trust Boundaries
Separate identity proof from session continuity and design browser authentication without exposing credentials or trusting client state.
Security Boundaries: Object Authorization, Input Validation, and Secret Handling
Enforce access on individual resources, keep data separate from executable structure, and prevent sensitive values from crossing logging and build boundaries.
Tenant authorization: carry trusted scope into every lookup
Bind resource access to authenticated tenant membership instead of treating object identifiers as permission.
CSRF defenses: reason from browser credential attachment, not CORS
Separate cross-site request forgery from cross-origin response access and validate state changes.