[Atomic Glue](atomicglue.co)

Home › Glossary › Security

Security terms

22 security terms, defined plainly and cross-referenced.

#ABC DEFGHIJKLMNO PQRSTUV W XYZ

#

No entries yet.

A

Authentication vs AuthorizationSecurityAuthentication verifies who you are (identity). Authorization determines what you are allowed to do (permissions). They are distinct but complementary security functions that are often confused.

B

No entries yet.

C

CAPTCHA / reCAPTCHA / TurnstileSecurityCAPTCHA and its modern alternatives (reCAPTCHA, Cloudflare Turnstile) are challenge-response tests used to distinguish human users from automated bots. They protect forms, login pages, and APIs from abuse.Cookie Attributes (Secure/HttpOnly/SameSite)SecurityCookie attributes (Secure, HttpOnly, SameSite) are flags set on HTTP cookies to control their security properties: encryption in transit, JavaScript access restrictions, and cross-origin sending behavior.CORSSecurityCORS (Cross-Origin Resource Sharing) is a browser security mechanism that controls how web pages from one origin can request resources from a different origin. It uses HTTP headers to define allowed cross-origin requests.CSPSecurityContent Security Policy (CSP) is a browser security standard that uses HTTP headers to control which resources (scripts, styles, images, fonts) a page is allowed to load, preventing XSS and data injection attacks.CSRFSecurityCross-Site Request Forgery (CSRF) is an attack that tricks an authenticated user into performing unintended actions on a web application by sending forged requests from another site.

D

DDoS ProtectionSecurityDistributed Denial-of-Service (DDoS) protection is a set of techniques and services that defend against attacks attempting to overwhelm a website or server with traffic, making it unavailable to legitimate users.

E

No entries yet.

F

No entries yet.

G

No entries yet.

H

HSTSSecurityHTTP Strict Transport Security (HSTS) is a security header that tells browsers to always connect to a website over HTTPS, never plain HTTP. It prevents downgrade attacks and SSL stripping.HTTPS / TLSSecurityHTTPS (HTTP Secure) is the encrypted version of HTTP, secured by TLS (Transport Layer Security). It encrypts all data between a browser and a web server, preventing eavesdropping, tampering, and forgery.

I

No entries yet.

J

JWTSecurityJSON Web Token (JWT) is a compact, URL-safe token format for representing claims between parties. It is commonly used for API authentication (Bearer tokens), OAuth 2.0 access tokens, and OIDC ID tokens.

K

No entries yet.

L

No entries yet.

M

MFA / 2FASecurityMulti-Factor Authentication (MFA) requires users to present two or more pieces of evidence to verify their identity. Two-Factor Authentication (2FA) is a subset requiring exactly two factors. MFA dramatically reduces account takeover risk.

N

No entries yet.

O

OAuth 2.0SecurityOAuth 2.0 is an authorization framework that enables third-party applications to obtain limited access to a user's resources without exposing their credentials. It powers 'Login with Google/Facebook/GitHub.'

P

Passkeys / WebAuthnSecurityPasskeys are a passwordless authentication standard using public-key cryptography. WebAuthn is the W3C API that enables passkeys. Users authenticate with biometrics, PIN, or device unlock rather than passwords.

Q

No entries yet.

R

No entries yet.

S

Security HeadersSecuritySecurity headers are HTTP response headers that instruct browsers to enable security protections. They prevent common attacks including XSS, clickjacking, MIME sniffing, and protocol downgrades.SQL InjectionSecuritySQL Injection (SQLi) is a code injection technique where an attacker inserts malicious SQL statements into application queries, potentially reading, modifying, or deleting database data. It is one of the oldest and most dangerous web vulnerabilities.SRISecuritySubresource Integrity (SRI) is a browser security feature that verifies externally hosted resources (scripts, stylesheets) have not been tampered with by comparing their cryptographic hash against a known value.SSHSecuritySSH (Secure Shell) is a cryptographic network protocol that lets you securely log into a remote server, execute commands, transfer files, and forward ports over an encrypted connection.SSL CertificateSecurityAn SSL certificate (technically a TLS certificate) is a digital file that binds a cryptographic key pair to an organization or domain identity. It enables encrypted HTTPS connections and is verified by a Certificate Authority (CA).SSOSecuritySingle Sign-On (SSO) is an authentication method that allows users to log in once and access multiple applications without re-entering credentials. It uses centralized identity providers and protocols like SAML, OIDC, or OAuth.

T

No entries yet.

U

No entries yet.

V

Vulnerability ScanningSecurityVulnerability scanning is the automated process of identifying security weaknesses in applications, systems, and networks. It checks for known vulnerabilities, misconfigurations, and compliance gaps before attackers can exploit them.

W

WAFSecurityA Web Application Firewall (WAF) filters, monitors, and blocks HTTP traffic to and from a web application. It protects against common attacks like SQL injection, XSS, and DDoS by inspecting and filtering HTTP requests.

X

XSSSecurityCross-Site Scripting (XSS) is a security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. It is one of the most common web application vulnerabilities, consistently ranked in the OWASP Top 10.

Y

No entries yet.

Z

No entries yet.