[Authentication vs Authorization](atomicglue.co/glossary/authentication-vs-authorization-security) — Authentication verifies who you are (identity). Authorization determines what you are allowed to do (permissions). They are distinct but complementary security functions that are often confused.
[CAPTCHA / reCAPTCHA / Turnstile](atomicglue.co/glossary/captcha-recaptcha-turnstile) — CAPTCHA and its modern alternatives (reCAPTCHA, Cloudflare Turnstile) are challenge-response tests used to distinguish human users from automated bots. They protect forms, login pages, and APIs from abuse.
[Cookie Attributes (Secure/HttpOnly/SameSite)](atomicglue.co/glossary/cookie-attributes) — Cookie attributes (Secure, HttpOnly, SameSite) are flags set on HTTP cookies to control their security properties: encryption in transit, JavaScript access restrictions, and cross-origin sending behavior.
[CORS](atomicglue.co/glossary/cors-security) — CORS (Cross-Origin Resource Sharing) is a browser security mechanism that controls how web pages from one origin can request resources from a different origin. It uses HTTP headers to define allowed cross-origin requests.
[CSP](atomicglue.co/glossary/csp-security) — Content Security Policy (CSP) is a browser security standard that uses HTTP headers to control which resources (scripts, styles, images, fonts) a page is allowed to load, preventing XSS and data injection attacks.
[CSRF](atomicglue.co/glossary/csrf) — Cross-Site Request Forgery (CSRF) is an attack that tricks an authenticated user into performing unintended actions on a web application by sending forged requests from another site.
[DDoS Protection](atomicglue.co/glossary/ddos-protection) — Distributed Denial-of-Service (DDoS) protection is a set of techniques and services that defend against attacks attempting to overwhelm a website or server with traffic, making it unavailable to legitimate users.
[HSTS](atomicglue.co/glossary/hsts) — HTTP Strict Transport Security (HSTS) is a security header that tells browsers to always connect to a website over HTTPS, never plain HTTP. It prevents downgrade attacks and SSL stripping.
[HTTPS / TLS](atomicglue.co/glossary/https-tls) — HTTPS (HTTP Secure) is the encrypted version of HTTP, secured by TLS (Transport Layer Security). It encrypts all data between a browser and a web server, preventing eavesdropping, tampering, and forgery.
[JWT](atomicglue.co/glossary/jwt-security) — JSON Web Token (JWT) is a compact, URL-safe token format for representing claims between parties. It is commonly used for API authentication (Bearer tokens), OAuth 2.0 access tokens, and OIDC ID tokens.
[MFA / 2FA](atomicglue.co/glossary/mfa-2fa) — Multi-Factor Authentication (MFA) requires users to present two or more pieces of evidence to verify their identity. Two-Factor Authentication (2FA) is a subset requiring exactly two factors. MFA dramatically reduces account takeover risk.
[OAuth 2.0](atomicglue.co/glossary/oauth-20) — OAuth 2.0 is an authorization framework that enables third-party applications to obtain limited access to a user's resources without exposing their credentials. It powers 'Login with Google/Facebook/GitHub.'
[Passkeys / WebAuthn](atomicglue.co/glossary/passkeys-webauthn) — Passkeys are a passwordless authentication standard using public-key cryptography. WebAuthn is the W3C API that enables passkeys. Users authenticate with biometrics, PIN, or device unlock rather than passwords.
[Security Headers](atomicglue.co/glossary/security-headers) — Security headers are HTTP response headers that instruct browsers to enable security protections. They prevent common attacks including XSS, clickjacking, MIME sniffing, and protocol downgrades.
[SQL Injection](atomicglue.co/glossary/sql-injection) — SQL Injection (SQLi) is a code injection technique where an attacker inserts malicious SQL statements into application queries, potentially reading, modifying, or deleting database data. It is one of the oldest and most dangerous web vulnerabilities.
[SRI](atomicglue.co/glossary/sri) — Subresource Integrity (SRI) is a browser security feature that verifies externally hosted resources (scripts, stylesheets) have not been tampered with by comparing their cryptographic hash against a known value.
[SSH](atomicglue.co/glossary/ssh) — SSH (Secure Shell) is a cryptographic network protocol that lets you securely log into a remote server, execute commands, transfer files, and forward ports over an encrypted connection.
[SSL Certificate](atomicglue.co/glossary/ssl-certificate) — An SSL certificate (technically a TLS certificate) is a digital file that binds a cryptographic key pair to an organization or domain identity. It enables encrypted HTTPS connections and is verified by a Certificate Authority (CA).
[SSO](atomicglue.co/glossary/sso) — Single Sign-On (SSO) is an authentication method that allows users to log in once and access multiple applications without re-entering credentials. It uses centralized identity providers and protocols like SAML, OIDC, or OAuth.
[Vulnerability Scanning](atomicglue.co/glossary/vulnerability-scanning) — Vulnerability scanning is the automated process of identifying security weaknesses in applications, systems, and networks. It checks for known vulnerabilities, misconfigurations, and compliance gaps before attackers can exploit them.
[WAF](atomicglue.co/glossary/waf) — A Web Application Firewall (WAF) filters, monitors, and blocks HTTP traffic to and from a web application. It protects against common attacks like SQL injection, XSS, and DDoS by inspecting and filtering HTTP requests.
[XSS](atomicglue.co/glossary/xss) — Cross-Site Scripting (XSS) is a security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. It is one of the most common web application vulnerabilities, consistently ranked in the OWASP Top 10.