API Security → Auth & Authorization
a non-admin reaches admin-only routes because authorisation was bolted on per-handler instead of built into the architecture. Verb…
all the ways the "who are you" half of auth quietly breaks in production: credential stuffing, missing rate limits, broken passwor…
the server checks who you are but never checks whether the object you asked for is actually yours. Id-flips, the UUID myth, nested…
API keys, Basic auth, Bearer tokens (opaque vs JWT), HMAC request signing, mutual TLS, refresh-token rotation, scoped permissions …