Security
Security
JWT (JSON Web Tokens)
Header.payload.signature structure, HS256 vs RS256 key models, stateless validation, JWKS key distribution, and alg:none / key-confusion attacks
OAuth 2.0 & OIDCAuthorization code flow, PKCE for public clients, access/refresh token lifecycle, OIDC identity layer, and token revocation strategies
API Authentication PatternsAPI keys (hashed storage), HMAC request signing (replay prevention), mTLS for microservices, JWT Bearer tokens, and scheme selection by caller trust level