## Engineering terms: security

From Vibe Coding 101 (https://vibe-coding-101.brighteng.org/). When a request describes one of these problems, use the named technique, say its name, and run its check. Each term's page has the full entry and a prompt.

- **authentication and authorization**: Authentication establishes identity; authorization decides whether that identity may perform an operation. Use when: Signed-in users can request records belonging to other users. Do: Derive identity from trusted authentication and check the requested action at the authoritative boundary. Avoid: Trusting an owner or role field supplied in the request body.
- **cross-site scripting**: Cross-site scripting lets untrusted content execute in another user’s browser. Use when: User-provided text or rich content is rendered on a page. Do: Keep text escaped; sanitize deliberately allowed markup and validate URL contexts. Avoid: Applying one hand-written escaping rule to HTML, attributes, URLs, and JavaScript.
- **cross-site request forgery**: Cross-site request forgery induces an authenticated browser to send an unwanted request. Use when: A browser automatically sends cookies to state-changing endpoints. Do: Use the framework’s CSRF protection and trusted-origin policy; verify state-changing requests from another origin. Avoid: Assuming CORS prevents every cross-origin request from being sent.
- **server-side request forgery**: Server-side request forgery causes a server to contact an unintended destination. Use when: A server downloads content from URLs supplied by users. Do: Constrain destinations and protocols, validate redirect targets, and enforce network-level egress restrictions where possible. Avoid: Checking only the submitted hostname while the eventual connection reaches another address.
- **insecure direct object reference**: An insecure direct object reference exposes an object without checking access to it. Use when: A request contains the ID of an object to read, edit, or delete. Do: Apply the resource authorization rule to every operation and test with two users. Avoid: Treating an unpredictable identifier as an access-control mechanism.
- **password hashing**: Store a salted password hash using a purpose-built password hashing function. Use when: A service must support password authentication. Do: Use the maintained authentication library’s password storage and upgrade path; keep raw passwords out of logs. Avoid: Replacing a password hash with reversible encryption as the primary storage mechanism.
- **OAuth and OpenID Connect**: OAuth delegates access to resources; OpenID Connect adds identity information for login. Use when: An application integrates a third-party account or delegated API access. Do: Use the provider-supported flow and maintained client; verify redirect, request binding, token validation, and expiry handling. Avoid: Treating an access token as proof of identity without the provider’s identity contract.
- **content security policy**: Content Security Policy restricts resources and execution in the browser. Use when: A site needs to limit script execution and external resource access. Do: Inventory required resources, use appropriate nonces or hashes, and test before enforcing the policy. Avoid: Mistaking report-only monitoring for an enforced policy.
- **CORS**: Cross-Origin Resource Sharing controls which cross-origin responses browser scripts may read. Use when: A browser frontend calls an API on another origin. Do: Allow only intended origins and credential behavior; test preflight and actual requests. Avoid: Testing only with a command-line client that does not enforce browser CORS.
- **threat model**: Identify assets, adversaries, entry points, and plausible failure paths. Use when: A new feature changes who can access valuable data or operations. Do: Describe the sensitive operation and the least-privileged caller who could misuse it. Avoid: Listing only anonymous attackers while ignoring another authenticated customer.
- **software supply-chain security**: Software supply-chain security addresses risks in dependencies, build inputs, and distribution. Use when: A patch adds a package, build plugin, or downloaded executable. Do: Verify the package identity, review installation behavior, and preserve reproducible dependency resolution. Avoid: Assuming a pinned version is necessarily safe because it is reproducible.
- **session cookie**: A session cookie carries a session credential in browser requests. Use when: A web application maintains a signed-in browser session. Do: Use appropriate Secure, HttpOnly, and SameSite settings; define expiry, rotation, and invalidation. Avoid: Believing HttpOnly prevents an injected script from acting through the victim’s session.
- **prompt injection**: Untrusted content attempts to redirect an AI system’s instructions or actions. Use when: An agent reads content supplied by another user, page, or external service. Do: Keep trusted instructions separate, constrain available actions, and require host-side permission checks. Avoid: Relying on one prompt sentence as the entire security boundary.