Glossary

117 terms from Web App Security and Authentication, in plain words, each with the chapter that teaches it.

Search the glossary

A

Absolute timeout: A rule that ends a session a fixed time after sign-in, however active the user is. kc-shop uses 8 hours.
Access token: A short-lived token sent with each API call to prove permission. It says what the app may do, not who is at the keyboard.
Account enumeration: Learning which emails have accounts because the app gives different replies for a wrong email and a wrong password. kc-shop gives one message for both.
additionalProperties: A JSON Schema keyword that controls whether a body may carry fields the schema doesn't list. With Fastify's defaults, extra fields like a sneaked-in total_cents are dropped before the handler runs.
Allowlist: A list of exactly what is accepted, with everything else refused; a blocklist lists what is refused instead. Allowlists are safer because you can't list every bad input.
app.inject: A Fastify method that sends a fake request straight to the app without a network or running server. kc-shop's tests use it for every probe.
Argon2id: A deliberately slow, memory-hard password hashing algorithm and OWASP's first choice. kc-shop uses m=19456, t=2, p=1 through the argon2 package.
ASVS: An OWASP checklist of requirements you can test an app against.
Authentication: Proving who someone is, such as signing in as Bloom Café. It is different from authorization, which decides what that person may do.
Authorization: Deciding what a signed-in user may do or see, such as whether Bloom may read order 2.
Authorization code flow: The OAuth flow where the browser carries a one-time code back from the provider and kc-shop's server swaps it for tokens. It uses state and PKCE for safety.
Authorization server: The authorization server signs users in and issues tokens (Kettle & Crane ID); the resource server is the API that accepts those tokens.

B

Base64url: A way to write bytes as URL- and cookie-safe text. kc-shop turns 32 random bytes into a 43-character session id this way.
BLOB: A database column type that stores raw bytes. kc-shop's passkeys table keeps each public key in one.
Brute force: Brute force tries many passwords on one account. Credential stuffing tries email and password pairs leaked from other sites.

C

Ceremony: One of the two short WebAuthn exchanges between server and device: registration, which stores a public key, and authentication, which checks a signed challenge.
Claim: One fact inside a token, such as email, sub, exp or email_verified in an ID token.
Clickjacking: An attack where another site shows your page invisibly in a frame and tricks a visitor into clicking. frame-ancestors and X-Frame-Options stop it.
Client: In OAuth, the client is the app asking for access (kc-shop) and the resource owner is the user who grants it (Bloom Café). The client secret proves server-to-server requests come from the client.
Code verifier: In PKCE, the verifier is a random value kept by kc-shop. The challenge is its SHA-256 hash, sent first, and the verifier is revealed only when swapping the code for tokens.
Command injection: User text passed to a shell command so that it runs as instructions. Use execFile, which runs no shell, instead of building command strings.
Cookie: A small named value a server sets with a Set-Cookie header and the browser sends back on later requests. curl's cookie jar (-c saves, -b sends) is a file of cookies.
CORS: Rules that relax the browser's block on pages reading replies from other origins. It is a loosening, not a defense, so kc-shop leaves it off.
Counter: A number some passkeys raise on every use. The server stores it and rejects a lower value, which suggests a copied key.
CSP: A response header that says where scripts, styles and images may load from. helmet's default blocks inline scripts, a second wall if escaping is missed.
CSRF: Another site making a signed-in browser send a request it never meant to, such as posting a note as Bloom. A secret per-session CSRF token that every form must send back refuses forged posts.
curl: A command-line tool that sends HTTP requests and shows the replies. Common options include `-i` to show response headers, `-d` to send form data, and `-c`/`-b` to save and send cookies.

D

declare module: A TypeScript block that adds to a library's existing types. kc-shop uses it to add a user property to Fastify's request type.
decorateRequest: A Fastify method that gives every request a named slot, such as user, so a hook can fill it in.
Defense in depth: Stacking several defenses so that if one fails the next still stops the problem. Kettle & Crane hashes passwords, limits logins and logs failures.
Deny by default: Refusing every request until a route proves who you are and that you're allowed. kc-shop's /me started by refusing everyone.
Dependabot: Update bots that open pull requests when fixes for your dependencies are released.
Discovery: A provider's published document listing its addresses and keys, so a library needs only the issuer URL.

E

Entity: An HTML code such as < that the browser shows as a character instead of running it. Escaping replaces & < > " ' with entities when output is written.
enum: A JSON Schema keyword that accepts only values from a fixed list. kc-shop uses it so sku must be a known product code.
Environment variable: A named setting supplied to a program from outside its code, such as OIDC_CLIENT_SECRET. kc-shop loads them from a .env file in development.
execFile: A function in node:child_process that runs a program with an array of arguments and no shell, avoiding command injection.

F

Fail closed: Failing closed means refusing when something unexpected happens. Failing fast means stopping at startup when something, like a secret, is missing.
Fastify: The Node.js web framework kc-shop is built on. Plugins add form parsing (formbody), cookies and rate limiting.
FIDO2: The umbrella name for WebAuthn plus the device side that makes passkeys work.

G

GDPR: Privacy laws (Europe's GDPR, California's CCPA) that can add fines when customer data leaks.
Git history: Every past commit git keeps. A secret committed once stays readable there even after the file is deleted, so rotate it. .gitignore lists files git must never track.

H

Hash function: A one-way function that turns text into a fixed-length fingerprint, with the same input always giving the same output. Slow hashing makes each guess costly for attackers.
Have I Been Pwned: A service whose range API checks new passwords against breaches. You send only the first five characters of the password's SHA-1 hash, so the password never leaves your server.
helmet: A Fastify plugin that adds a group of protective response headers, including CSP, HSTS, nosniff and Referrer-Policy.
HSTS: A header that tells browsers to use HTTPS only for this site for a year, even if someone types http://.
HTTP status codes: Three-digit codes in an HTTP reply that say what happened. In kc-shop: 201 Created (new order made), 303 See Other (load another address with a GET, used after a form post), 400 (input broke the schema or a sign-in callback failed), 401 (not signed in), 403 (known user but not allowed, or a missing CSRF token), 404 (not found, or not yours), 409 Conflict (valid request, wrong state), 415 (unsupported body type, such as a form post without formbody), 429 (rate limit hit) and 500 (unexpected error, with no details shown).
HttpOnly: Cookie flags: HttpOnly hides the cookie from page scripts, Secure sends it only over HTTPS, and SameSite (Strict, Lax or None) limits sending it on cross-site requests.
HTTPS: HTTP over an encrypted connection. Secure cookies are sent only over it, and HSTS tells browsers to insist on it.

I

ID token: A signed JWT that OpenID Connect providers return to say who signed in and for which client.
Idle timeout: A rule that ends a session after a stretch of no use, by pushing expires_at forward on each request.
IDOR: Fetching a record by an id from the request without checking whether this user may see it, such as Bloom changing /orders/1 to /orders/2.
Implicit flow: An older OAuth flow that sent tokens to the browser in the URL. Current guidance says not to use it.
Injection: User text becoming part of a command that the interpreter reads as instructions, such as search text that changes an SQL query. It is OWASP A05.
Install scripts: Scripts a package may run when installed. npm install --ignore-scripts skips them, but argon2 needs its script.
Issuer: The provider's base URL, also the iss claim in its tokens. The aud claim names the client id the token was made for, and openid-client checks both.

J

JSON Schema: A description of the shape a JSON body or query must have, such as type, length and allowed values. Fastify checks it and replies 400 before your handler runs.
JWT: A signed token that carries its data inside it, so the client keeps it. An ID token is a JWT; a JWT works until it expires unless you keep a block list.

L

loadConfig: kc-shop's startup function that reads settings from the environment and throws if OIDC_CLIENT_SECRET is missing. Values live in a git-ignored .env file, with a committed .env.example.
Lockfile: package-lock.json records every package's exact version and integrity hash. npm ci installs exactly that and fails if a download's hash differs.

M

Memory-hard: Needing a lot of memory per hash, as Argon2id does (19 MiB here), so attackers can't run thousands of guesses at once on graphics chips.
Multi-factor authentication: Signing in with more than one kind of proof, such as a device you have plus a fingerprint or PIN. A passkey counts as multi-factor on its own.

N

node:sqlite: Node's built-in SQLite database module, marked experimental. kc-shop uses it with ? placeholders for all values.
node:test: Node's built-in test runner, which npm test uses to find and run the .test.ts files.
nosniff: A header telling the browser to trust the declared Content-Type and not guess that a text file is a script.
npm audit: A command that checks your installed package versions against a public list of known vulnerabilities. Run it before each release.

O

OAuth 2.0: OAuth 2.0 lets one app act for a user at another service without seeing their password. OpenID Connect adds an ID token saying who signed in.
oauth2-mock-server: A local test OIDC provider that signs you in at once with no screen, so kc-shop can practice offline.
onRequest hook: A Fastify hook that runs before every route. kc-shop's fills request.user from the sid cookie and also checks the Origin header.
Open redirect: A page that sends people to any address in a request, like ?next=, lending your domain's trust to a look-alike site. Accept only paths on your own site.
openid-client: The library kc-shop uses for OIDC. It does discovery and the code exchange, and checks the ID token's issuer, audience, expiry and signature.
Origin: Scheme, host and port together, like https://shop.kettleandcrane.com. A site is only the scheme and main domain, so shop. and api. subdomains are one site.
Output encoding: Validation checks input against rules when it arrives. Output encoding makes text safe for where it is displayed. You need both.
OWASP: The Open Worldwide Application Security Project, a nonprofit that publishes free security guidance. Its best-known paper, the OWASP Top 10, lists the ten most serious web app risks, numbered A01 to A10.
Ownership check: Code that confirms a record belongs to the signed-in user (or that the user may read any) before returning it. It is the fix for IDOR.

P

Passkey: A sign-in key pair for one site whose private key stays on the device. Origin binding means a look-alike site gets no usable signature. Synced passkeys copy across devices; device-bound ones never leave one.
Password hashing alternatives (bcrypt, scrypt, PBKDF2): Other slow password hashes OWASP lists after Argon2id. scrypt (N=2^17, r=8, p=1) is the choice if Argon2id isn't available; bcrypt (work factor 10+) is for older systems and uses only the first 72 bytes; PBKDF2 (600,000 rounds of HMAC-SHA-256) is for where FIPS rules require it.
Path traversal: A file name like ../../.env that climbs out of the folder you meant. Resolve the full path and refuse it unless it still starts with your folder.
Pepper: A secret added to every password before hashing and kept outside the database, so a stolen database alone isn't enough to start guessing.
Permission: A permission is a named action like orders:update. RBAC gives each user a role and each role a list of permissions, so code asks 'may this user do this?'
pino: The logger built into Fastify. kc-shop passes it settings, such as redact, to keep cookies out of logs.
PKCE: A verifier and challenge pair that makes a stolen authorization code useless, because swapping it for tokens needs the verifier only kc-shop holds.
Placeholder: A ? in SQL that is filled with a value sent separately, so the database never reads the value as SQL.
Plugin: A add-on registered with app.register that adds features or routes to a Fastify app, such as formbody, cookie, rate-limit or helmet.
Prefix: An option to app.register that puts a path, like /api, in front of every route a plugin adds.
Privilege escalation: Reaching another user's data at your own level (horizontal, Bloom reading Hearth's order) or a higher role's actions (vertical, a customer using a staff action).
Public-key cryptography: Key pairs where the private key signs and the public key can only check signatures. Passkeys rely on this, so a leaked public key is useless for signing in.

R

Rainbow table: A rainbow table is a precomputed list of common passwords and their hashes. A salt, random bytes stored with each hash, makes equal passwords differ and defeats these tables.
Rate limiting: Capping requests per client per time window. kc-shop allows 5 logins a minute per IP, and the sixth gets 429 with a retry-after header giving the seconds to wait.
Redact: A pino option that replaces chosen log fields, such as cookie headers, with [Redacted], so a later change can't leak them into logs.
Redirect URI: The exact address you register with a provider that it may send the user and code back to, such as http://localhost:3000/callback.
Refresh token: A long-lived token kept safe and used only to get new short-lived access tokens. Replacing it on each use makes a stolen copy stop working.
Regression test: A test that keeps a fixed problem fixed. kc-shop's test/security.test.ts collects one for each defense.
Relying party: The relying party is the site a passkey signs in to, named by its domain (the rpID). A challenge is a random single-use value the passkey signs so recordings can't be replayed.
requireUser: kc-shop's access helpers: requireUser returns the signed-in user or throws 401, can checks a role's permission and denies unknown roles, and HttpError carries a status code for Fastify to reply with.
Reset token: A random, single-use, short-lived value in a password-reset link, with only its hash stored. A reset is a second way into every account.

S

SAML: A standard for enterprise single sign-in, where a company's identity provider vouches for a user so they can sign in to other apps without a separate password.
Scope: A named piece of access an OAuth client asks for, such as email or openid. The person sees it and agrees.
Secret: A value that grants access, like an API key or the client secret. If one leaks, rotate it: make a new one, use it and cancel the old one.
Session: The server's record that a browser is signed in, kept in a sessions table. The browser holds only the random session id in a cookie that points to it.
Session fixation: Planting a session id the attacker knows in a victim's browser and waiting for sign-in. The fix is a new session at every login.
SHA-256: A fast, common hash function built into Node. It is unsuitable for password storage because speed lets attackers guess quickly.
Shared secret: A value both you and the server know, like a password. Anyone who learns it can use it, which is the weakness passkeys remove.
SimpleWebAuthn: The library kc-shop uses to build and check WebAuthn registration and sign-in messages, with server and browser halves.
SKU: A product code like mug-blue. The client sends only a SKU and quantity, and the server looks up the price.
SSRF: Tricking a server into fetching a URL an attacker chose, such as an internal address only the server can reach. Fetch only from an allowlist of hosts.
Stack trace: An error's detailed trail of file paths and code lines. It must never reach users, because it reveals internals.
State: A random OAuth value saved in a cookie before sign-in and compared at the callback, tying it to the browser that started it.
Status table: kc-shop's rules for order statuses written as data, with each status listing the statuses it may move to. Shipped and cancelled map to empty lists.
sub: The provider's permanent id for a person in an ID token. email_verified says whether the provider confirmed the email, and kc-shop trusts email only when it's true.
Supply chain: Every package your app depends on. Typosquatting is a harmful package named one typo from a popular one.

T

Threat modeling: Asking what you protect, who might attack, what could go wrong and what you'll do, before you build.
Timing-safe compare: Comparing secrets in the same time however much matches, so timing can't leak them bit by bit. kc-shop's sameToken uses Node's timingSafeEqual.
trustProxy: A Fastify option for apps behind a proxy, so the app sees the real protocol and client address, which rate limits need.

V

Vulnerability: A weakness that lets someone make an app do what its owner never meant, like reading another café's orders.

W

WebAuthn: The browser API that passkeys use, with registration and authentication ceremonies.

X

XSS: User text sent back inside a page that the browser runs as script. Stored XSS is saved first, like an order note; reflected XSS bounces straight back from the request.