Blog
Tutorials, guides, and insights to help you become a better developer.
Take a JSON Web Token apart segment by segment, build a signer and verifier with nothing but node:crypto, then run the alg:none and RS256-to-HS256 key-confusion attacks against both your own code and jose@6.2.8 to see exactly which one still forges an admin token.
AdminAugust 6, 202611 min read
TLS isn't just a padlock — it's a carefully choreographed cryptographic handshake. Here's what actually happens between your browser and the server, with the openssl commands to see each step yourself.
AdminMarch 6, 202611 min read