Password Hashing Algorithm Selection and Work Factor Tuning
Store passwords with a slow, salted, purpose-built hashing algorithm, not a fast general hash. Argon2id is the usual first choice for new systems, with scrypt,...
Category
Cybersecurity/Networking
Brute Force Protection and Rate Limiting for Login Endpoints
Protect login endpoints with layered defenses: rate limit by account and by source, slow down repeated failures progressively, require multi-factor...
TLS Configuration Best Practices for Public Web Servers
A solid TLS configuration for a public web server enables TLS 1.2 and 1.3, disables older protocols, uses modern cipher suites, automates certificate renewal,...
CORS Configuration Best Practices for Browser Facing APIs
CORS, or Cross-Origin Resource Sharing, lets a server tell browsers which other origins may read its responses. Best practice is to allow only specific,...
DNS CAA Records and Certificate Issuance Controls
CAA DNS records communicate which certificate authorities are authorized to issue certificates. Start with a clearly defined correctness invariant and...
API Idempotency Key Design for Safe Payment Retries
Payment APIs may receive repeat requests after network timeouts even when the first charge succeeded. Start with a clearly defined correctness invariant and...
Secrets Management Best Practices for Containerized Applications
Secrets in containerized applications should never be baked into images or committed to source control. Inject them at runtime from a dedicated secret store or...
JWT Refresh Token Rotation Best Practices for Web APIs
Refresh token rotation means issuing a new refresh token every time one is used and invalidating the old one. Combined with short-lived access tokens, it...
Content Security Policy Rollout Strategy With Report Only Mode
The safest way to roll out a Content Security Policy is to start in report-only mode, collect violation reports, fix or allow legitimate sources, and only then...