What is a firewall? Types and how they workA plain explanation of firewalls — what they filter, the main types, and what they cannot protect.JWT explained: what a JSON Web Token is and how it worksWhat a JSON Web Token is, how the header.payload.signature structure works, which claims and algorithms exist, and how to validate JWTs safely.TLS versions explained: from SSL 3.0 to TLS 1.3Every TLS version from SSL 3.0 to TLS 1.3 explained — what changed, what broke, and why old versions are now disabled by default.SSH explained: how Secure Shell worksSSH explained: what Secure Shell is, how the protocol works end to end, and why it replaced telnet and rsh.What is authentication? Passwords, biometrics, SSO, and modern methods explainedAuthentication is the process of verifying who you are. Learn how passwords, multi-factor authentication, biometrics, SSO, OAuth, and password managers work — and which methods offer the best protection for your application.What is CSRF (Cross-Site Request Forgery)? How it works and how to prevent itCross-Site Request Forgery (CSRF) tricks a logged-in browser into sending unwanted requests to a trusted site. This guide explains how the attack works and the defenses that stop it.What is SQL injection? How it works and how to prevent itSQL injection is one of the most common web vulnerabilities — this guide explains how it works, the main attack types, and the secure coding practices that prevent it.What is SSRF (Server-Side Request Forgery)? How it works and how to prevent itServer-Side Request Forgery (SSRF) lets an attacker abuse a server's own URL-fetching feature to reach internal systems and cloud metadata. This guide explains the attack and the defenses that stop it.What is XSS (Cross-Site Scripting)? How it works and how to prevent itCross-Site Scripting (XSS) lets an attacker run their own JavaScript in another user's browser. This guide explains how the three types work and the defenses that stop them.What is a Content Security Policy (CSP)? How CSP works and how to deploy itA Content Security Policy (CSP) is an HTTP security header that tells a browser which resources a page is allowed to load. Learn how CSP works, what directives are available, and how to deploy it without breaking your site.What is HSTS (HTTP Strict Transport Security)? How it works and why it mattersHTTP Strict Transport Security (HSTS) is a web security policy that forces browsers to only use HTTPS. Learn how the Strict-Transport-Security header works, what it protects against, and how HSTS preload lists eliminate the SSL-stripping window.How to add JWT authentication to a Node.js API: a practical guideStep-by-step implementation of JWT authentication on a Node.js/Express API: password hashing, login endpoint, token verification middleware, refresh tokens, and the common security pitfalls.What is OAuth 2.0? How OAuth works and how to secure itOAuth 2.0 is an open standard for delegated authorization defined in RFC 6749. It lets a user (the resource owner) grant a third-party application (the client) limited access to resources on another server without sharing their password. This guide explains the four roles, the main grant types, the recommended authorization-code flow with PKCE, and the security best practices from RFC 9700.How to set up SSH key authentication (GitHub + Linux)Set up SSH key authentication for GitHub and Linux servers: generate Ed25519 keys, add to ssh-agent, copy public key, and test connection — step-by-step with open-license sources.How to use the Web Crypto API in the browser: hashing, signing, and encryptionThe Web Crypto API gives every browser a built-in cryptography engine. Learn how to hash data, sign and verify messages, and encrypt or decrypt content using SubtleCrypto — with practical code examples and security notes. 