Why Decoding a JWT Is Not Verifying It (And How Security Bugs Slip Through)
Decoding a JWT only unmasks Base64URL strings. Here is how alg: none bypasses, algorithm confusion, and unverified claims slip into production.
Oct 7, 20266 min read
Command Palette
Search for a command to run...
Latest articles
Why Your SVG Icons Break When Converted to Web Fonts (And How to Fix Inverted Glyphs)
Converting SVGs into custom icon fonts sounds straightforward until you compile your first glyph set. You export ten clean icons from Figma or Illustrator, feed them into an icon font generator, and o
Oct 5, 20265 min read1
JSON Formatting Is Not Validation: A Practical Debugging Checklist
A neatly indented API response can still contain the wrong data. Before treating JSON as trustworthy, separate three questions: does it parse, does it match the expected structure, and does it satisfy
Oct 5, 20262 min read3JWT Decoding vs Cryptographic Signature Verification: What Developers Can and Cannot Learn from a Token
Last Tuesday, a staging auth bug had three devs stumped for half an afternoon. Nginx was spitting 401 Unauthorized. But the tester dumped their Bearer token into Chrome's DevTools console, ran JSON.pa
Oct 5, 20266 min read
Why your cURL command works in terminal but fails in Python (4 gotchas that wasted my afternoon)
We've all been there: you open Chrome DevTools, click Copy as cURL, paste it into your terminal, and it works like a charm. Then you rewrite it into Python requests or httpx, hit run, and suddenly: HT
Sep 29, 20264 min read