Node.js, Express & HTTP
Trace requests, understand the runtime, and build reliable APIs.
JWT vs refresh token: what is the difference?
JWT is a token format, not a role: an access token can be a JWT or another format. An access token authorizes calls to an API, while a refresh token is used with the identity service to obtain new access tokens. Separating these roles limits how long a stolen access token is useful and supports longer login sessions.
OAuth vs OIDC: what is the difference?
OAuth is a framework for delegated access, allowing a client to act with limited permission on protected resources. OpenID Connect (OIDC) adds a standard identity layer for user login on top of OAuth. The authorization code flow separates browser redirects from the token exchange and commonly uses PKCE to protect that exchange.
How do I prevent injection, XSS, CSRF and SSRF?
Injection, XSS, CSRF and SSRF attack different trust boundaries. Injection changes a database command, XSS runs unwanted browser code, CSRF abuses automatically attached credentials, and SSRF makes a server contact an unintended destination. Input validation helps, but each attack also needs controls at the point where the dangerous action happens.
Difficulty is an editorial estimate. Completion means you chose to mark a question as understood.