cybersecurity
12 posts on cybersecurity, newest first.
- 9 min read
What Is Salting? Password Salting Explained With Python Code
What is salting? A salt is a unique random value added to each password before hashing. See why plain SHA-256 leaks, then salt by hand and with Argon2id.
- 9 min read
ID Token vs Access Token: What Each One Is For (with a Demo)
ID token vs access token: the ID token tells your app who signed in, the access token tells your API what the caller may do. Real decode and validation runs.
- 9 min read
MCP Authorization: Protect an MCP Server with OAuth 2.1
How MCP authorization works: the 401, protected resource metadata and OAuth 2.1 flow, plus a runnable Python SDK server that rejects requests without a valid token.
- 11 min read
Claude --dangerously-skip-permissions: What It Does and When to Use It
What claude --dangerously-skip-permissions really does, why it refuses to run as root, the six Claude Code permission modes, and safer ways to stop the prompts: allow rules, sandbox, auto mode.
- 19 min read
Ghidra MCP: Install and Use GhidraMCP for AI Reverse Engineering
Ghidra MCP setup, tested: install Ghidra 12.1.4 and GhidraMCP 2.0 (GUI or headless), connect Claude Code, then find zlib's Adler-32 in a stripped binary.
- 10 min read
STRIDE Threat Modeling Explained with an Example
STRIDE threat modeling walked through on a chat app: spoofing, tampering, repudiation, information disclosure, DoS and elevation of privilege.
- 6 min read
Mastering Openssl Command and NSS Database Management
Practical OpenSSL and certutil guide: inspecting certificates, managing PKCS#12 (PFX) files, and working with the NSS certificate database.
- 12 min read
Unlocking Web Security: Master JWT Authentication
Understand JWT claims, token structure and signing algorithms, then build JWT authentication from scratch in Node.js with complete, runnable example code.
- 6 min read
OAuth 2.0 Authorization Code Flow, Step by Step
The OAuth 2.0 authorization code flow step by step: each redirect and request, why the server returns a code instead of an access token, and its benefits.
- 6 min read
OAuth 2.0 Grant Types Explained (Is PKCE One?)
The OAuth 2.0 grant types compared: authorization code, implicit, password, client credentials and refresh tokens, plus where PKCE fits.
- 7 min read
HTTP Basic Authentication Explained (RFC 7617)
How HTTP Basic Auth works: the Authorization header, Base64 username:password, why it needs HTTPS, plus a Node.js and TypeScript middleware example.
- 7 min read
Password Authentication in Node.js: A Step-by-Step Guide
Password-based authentication remains one of the most common and widely used methods to verify user identity in various online systems. It involves users providing a unique combination of a username…