Tag
NewA password hash is the one function in your codebase you want to be slow. One RTX 4090 runs MD5 at 164 billion guesses a second and bcrypt at 184 thousand. Here are the parameters OWASP, RFC 9106 and NIST actually publish, and why memory cost is the setting that hurts an attacker most.
Two things would prevent most OAuth bugs. OAuth answers what a caller may access, not who they are, so using it to log people in is a category error. And the flow chart everyone agonized over has collapsed: authorization code plus PKCE, for every client type, no exceptions.
JWTs are the default choice for new apps and usually the wrong one. The reason is revocation: there is no row to delete. And the standard fix, a server-side denylist, reintroduces the database lookup that was the entire point of going stateless.
An API is the contract that lets one piece of software ask another for something without knowing how it works inside. Here is what that means, from the waiter analogy down to endpoints, JSON, keys, and rate limits, plus why APIs quietly run the whole economy.
