{
  "id": 3757921,
  "title": "Security Fundamentals for Web Developers: Authentication, Authorization, and the Attacks You Need to Prevent",
  "url": "https://urgent.news/2026/08/27/security-fundamentals-for-web-developers-authentication-authorization",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-08-27T14:37:19.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/apeder/security-fundamentals-for-web-developers-authentication-authorization-and-the-attacks-you-need-4a56"
  },
  "original_language": "en",
  "account": "In 2012, LinkedIn suffered a significant data breach that exposed the password hashes of 6.5 million users. The compromised hashes used the unsalted SHA-1 algorithm, which is extremely vulnerable to rapid cracking using modern GPUs. Within days, attackers had recovered approximately 60% of the passwords in plaintext form. This incident demonstrates that breaches often occur due to basic security oversights rather than sophisticated attacks. To prevent such breaches, developers should employ salting (adding random data to each password before hashing) and use slow hashing algorithms such as bcrypt, scrypt, or Argon2. These techniques make password cracking computationally infeasible. The breach at LinkedIn resulted in a $1.25 million settlement, a decade of damage to the company's reputation, and the compromise of millions of user accounts. This serves as a stark reminder that web security breaches are frequently the result of developers unknowingly implementing basic security measures. Key concepts covered in this guide include the distinction between authentication and authorization, the use of JSON Web Tokens (JWTs), password hashing, preventing the OWASP Top 10 vulnerabilities, and implementing essential security headers. Understanding these foundational security principles is crucial for developers to avoid shipping applications susceptible to common web security attacks.",
  "summary": "Authentication vs authorization, JWT deep dive, OAuth 2.0, password hashing, XSS/CSRF/SQL injection prevention, and security headers. The Developer Who Stored Passwords in Plaintext In 2012, LinkedIn suffered a breach that exposed 6.5 million password hashes. The hashes were unsalted SHA-1 — a hashing algorithm so fast that an attacker with a modern GPU could crack billions of hashes per hour.…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}