#web development

Chrome made SameSite=Lax the default and most CSRF vulnerabilities quietly stopped working. That is real protection nobody implemented, and it leaves three specific gaps, one of which turns on the fact that SameSite was never about origins in the first place.

Two things would prevent most OAuth bugs. OAuth answers what a caller may access, not who they are, so using it to log people in is a category error. And the flow chart everyone agonised over has collapsed: authorization code plus PKCE, for every client type, no exceptions.

JWTs are the default choice for new apps and usually the wrong one. The reason is revocation: there is no row to delete. And the standard fix, a server-side denylist, reintroduces the database lookup that was the entire point of going stateless.

Frontend is what you see, backend is what you don't, and full stack is doing both. Here is what each role actually builds, the tools they use, and honest career advice if you are just starting out.

An API is the contract that lets one piece of software ask another for something without knowing how it works inside. Here is what that means, from the waiter analogy down to endpoints, JSON, keys, and rate limits, plus why APIs quietly run the whole economy.

HTML defines what a page contains. CSS defines how it looks. The relationship between them is one of the cleanest separation-of-concerns examples in computing, and it’s also a lot more nuanced than most beginner tutorials let on.

jQuery is a JavaScript library that dominated web development for a decade. The reason it existed, and the reason it doesn’t need to anymore, is most of the story of how the modern web got built.

reCAPTCHA v3 dropped the checkbox and the traffic-light puzzles in favor of a silent score from 0 to 1. That is a real usability win and a real set of tradeoffs. Here is what you actually sign up for.