Security Glossary

JWT

JSON Web Token

A compact, URL-safe format (RFC 7519) for a set of claims, usually a signed JWS. A signature lets the receiver check that the claims were not altered and who signed them. It does not make the contents secret: the payload of a signed JWT is only Base64URL-encoded, and anyone holding the token can read it.

Algorithm confusion

A class of JWT flaws where the verifier trusts the alg header supplied by the token instead of an algorithm fixed by the application, so a token can ask to be checked with a weaker method (including none) or with a public key used as an HMAC secret. The fix is to pin the accepted algorithms per key on the verifying side.

HMAC

Hash-based Message Authentication Code

A construction that combines a secret key with a hash function (for example SHA-256) to produce a tag. Whoever holds the same key can recompute the tag and confirm that the message came from a key holder and was not changed. Compare tags with a constant-time function, not ordinary string equality.

Webhook signature

A header on an incoming webhook request, typically an HMAC of the raw request body, that lets the receiver check the request came from the sender. The HMAC must be computed over the exact bytes received; parsing and re-serializing the JSON first usually breaks the match.

Base64URL

A variant of Base64 that uses - and _ instead of + and /, and usually omits the = padding, so the output can sit in URLs and filenames. JWT segments use it. It is an encoding, not encryption: anyone can reverse it.

SHA-256

Secure Hash Algorithm 256-bit

A cryptographic hash function from the SHA-2 family (FIPS 180-4) that maps any input to a 256-bit digest. It is suited to integrity checks such as file checksums. It is fast by design, so on its own it is the wrong tool for storing passwords.

Hash collision

Two different inputs that produce the same digest. Practical collision attacks exist for MD5 and SHA-1, so neither should be used where an attacker can choose the inputs, such as signatures or certificate checks. Checking a download against a published SHA-256 value is a different, still valid use.

Salt

A unique random value stored next to a password hash and mixed into the hash input, so identical passwords produce different hashes and precomputed tables stop working. A salt does not slow down guessing; that is the job of a slow password hashing function such as Argon2id, scrypt or bcrypt.

Entropy (passwords)

A measure, in bits, of how many guesses an attacker needs on average against a secret chosen by a given random process. It describes the generation method, not a single string: a password you picked yourself cannot be given a reliable entropy figure just by counting characters. A random passphrase of n words from a list of N words has n x log2(N) bits.

UUID

Universally Unique Identifier

A 128-bit identifier written as 32 hex digits in five groups. Version 4 is random; version 7 puts a timestamp first so values sort by creation time. Uniqueness is probabilistic, and a UUID is an identifier, not a secret: do not use one as an access token unless it came from a cryptographically secure generator and is treated as a credential.

Unix time

Seconds since the Unix Epoch

The number of seconds since 1970-01-01 00:00:00 UTC, not counting leap seconds. Many APIs use seconds (10 digits today) while JavaScript Date uses milliseconds (13 digits), a frequent source of off-by-1000 bugs.

SQL injection

A flaw where untrusted input is concatenated into a SQL statement, so the input can change the statement's structure. Parameterized queries send the SQL text and the values separately and prevent this for values, but not for identifiers such as table names or ORDER BY columns, which need an allowlist.

SSRF

Server-Side Request Forgery

A flaw where the server fetches a URL that an attacker influences, letting the attacker reach internal services or cloud metadata endpoints the server can see but the attacker cannot. Defences include allowlisting destinations and checking the resolved IP address that is actually connected to.

BOLA

Broken Object Level Authorization

An API flaw where the server accepts an object identifier from the client (for example /orders/1043) without checking that the caller may access that specific object. Also known as IDOR. Hard-to-guess identifiers do not fix it; an authorization check on every object access does.

Mass assignment

A flaw where request fields are bound directly to an internal object, so a client can set properties it should not control, such as role or isAdmin. Prevent it by binding only an explicit allowlist of fields.

HTTP request smuggling

An attack that exploits two HTTP components, such as a gateway and a back-end server, disagreeing about where one request ends and the next begins, usually through conflicting Content-Length and Transfer-Encoding headers. The attacker's bytes can then be read as the start of another user's request.

Rate limiting

Capping how many requests a client may make in a time window. It limits brute force, scraping and resource exhaustion, but it only works if the limit key cannot be rotated cheaply: limiting by IP alone, or by a spoofable header, is easy to bypass.

Open redirect

A redirect whose destination is taken from a request parameter without validation. In OAuth, an unvalidated redirect_uri can send authorization codes or tokens to an attacker-controlled address, so redirect URIs must be matched exactly against a registered list.

Shadow API

An API endpoint that is running and reachable but missing from the organization's inventory, documentation or gateway policies, so it is not monitored or patched like the known ones. Old versions and debug endpoints are common examples.

Secret leakage

Exposure of credentials such as API keys, tokens or private keys through source control, logs, shared .env files or build artifacts. A leaked secret should be treated as compromised: revoke and rotate it, because deleting the commit or message does not remove copies.

CVE

Common Vulnerabilities and Exposures

A public identifier (CVE-YYYY-NNNN) assigned to a specific vulnerability so that advisories, patches and scanners can refer to the same issue. A CVE record identifies the flaw; it is not a severity rating, which comes from separate scoring such as CVSS.