🔒 Security
Authentication, authorisation, sandboxing, and the constant vigilance mindset.
5 concepts
1
JSON Web Tokens (JWT)
A signed JSON payload. The server signs it; the client stores it in a cookie; the server verifies the signature on every request.
›
2
Cookie security flags
httpOnly (no JS access), Secure (HTTPS only), SameSite (CSRF defence).
›
3
Sandboxing user code
Allowlist commands, block dangerous patterns, cap memory & time, isolate processes.
›
4
Input validation
Never trust user input. Pydantic models enforce length, type, and regex at the boundary.
›
5
Cross-site scripting (XSS) defence
Always escape user content before inserting into HTML. escapeHtml() is your best friend.
›