Security
(10 posts)Security fundamentals for developers — OAuth, JWT, OWASP Top 10, and secure CI/CD. Practical guides to protect your APIs and Android apps.
All Posts
CSRF, XSS & SQL Injection — Practical Prevention in Spring Boot
Understand CSRF, XSS, and SQL injection attacks — what they are, how they exploit web applications, and how to prevent each one in Spring Boot with practical examples.
Spring Security — Role-Based Access Control (RBAC)
Implement role-based access control in Spring Boot 4 — roles vs authorities, @PreAuthorize, method-level security, hierarchical roles, and database-backed permissions.
Secure CI/CD — Signing APKs, Protecting Secrets in GitHub Actions
Secure your Android CI/CD pipeline — APK signing in GitHub Actions, keystore management, secret protection, artifact verification, and supply chain security.
API Rate Limiting & Abuse Prevention
Implement API rate limiting — token bucket, sliding window, per-user and per-IP limits, Spring Boot implementation with Bucket4j, and abuse prevention strategies.
CORS Explained — Why Your API Rejects Frontend Requests
Understand CORS from the ground up — what it is, why browsers enforce it, preflight requests, how to configure it in Spring Boot, and common debugging tips.
Secrets Management — Environment Variables, Vault & Sealed Secrets
How to manage secrets in production — environment variables, HashiCorp Vault, Kubernetes Sealed Secrets, and patterns for keeping credentials out of code.
Securing Android Apps — Certificate Pinning, ProGuard & Network Security Config
Harden your Android app — network security configuration, certificate pinning, ProGuard/R8 obfuscation, encrypted storage, and preventing reverse engineering.
API Security Checklist — OWASP Top 10 for Backend Developers
A practical API security checklist covering authentication, authorization, input validation, rate limiting, and the OWASP API Security Top 10 risks.
JWT Deep Dive — Structure, Signing, Validation & Common Mistakes
Understand JSON Web Tokens from the inside — header, payload, signatures, HMAC vs RSA, token validation, refresh strategies, and the mistakes that lead to security breaches.
OAuth 2.0 & OpenID Connect — How Authentication Actually Works
Understand OAuth 2.0 and OpenID Connect from the ground up — flows, tokens, scopes, and how to implement Google/GitHub login in your app without the confusion.