Skip to content
Here Be Dragons

Auth and browser security, post series

This series starts at the browser boundary and moves outward. The practical question is always the same: what can an attacker reach, what does the platform protect by default, and where does the application need an explicit control?

Reading order

  1. Modern web browser security, same-origin policy, CORS, CSP, headers, and browser-side attack surfaces.
  2. Sessions, JWTs, and cookies, where auth credentials live and which attacks reach them.
  3. Stateless auth, what JWTs buy, what they do not, and why revocation pulls state back in.
  4. Throttling and rate limiting, abuse limits, fairness limits, Redis-backed counters, and response semantics.
  5. Grok, Morse code, and $175K, prompt injection as a capability-boundary failure.
Why the name "Here Be Dragons"?