<aside> 💡 Generated by BigBrain. Repeated material was merged while distinct trade-offs, caveats, examples, and operational details were retained.

</aside>

11 - Security, Authentication, and Network Boundaries

Overview

This reference page explores key concepts and mechanisms in security, authentication, and network boundaries. Topics include authentication and authorization methods, JSON Web Tokens (JWTs), cookies and sessions, Transport Layer Security (TLS), mutual TLS (mTLS), proxies, VPNs, and trust boundaries. The focus is on understanding the trade-offs, failure modes, and best practices for designing secure systems.

Authentication and Authorization

Cookies and Sessions

HTTP is a stateless protocol, meaning each request is independent. To maintain user state across requests, cookies and sessions are commonly used.

Cookies

A cookie is a key-value pair stored in the browser. It is set by the server via the Set-Cookie response header and sent back to the server with subsequent requests. Cookies can store user identifiers or session tokens.

Key considerations:

• Cookies can be flagged as Secure to ensure they are only sent over HTTPS.
• The HttpOnly flag restricts access to cookies from JavaScript, reducing the risk of XSS attacks.
• Cookies are vulnerable to tampering and are not suitable for storing sensitive data.

Sessions

Sessions provide a more secure alternative by storing user data on the server. The server generates a unique session ID, stores it in a session store (e.g., database or cache), and sends the session ID to the client as a cookie.

Advantages of sessions:

• Sensitive data remains on the server, reducing exposure.
• Sessions can be centrally managed, allowing for invalidation, expiration, or revocation.