Glossary

A set of rules that lets different software applications communicate. An API defines how requests are made, what data is exchanged, and what responses are expected. Most modern web apps use REST or GraphQL APIs.

The process of verifying who a user is. Common methods include passwords, magic links, OAuth (Google/GitHub login), and multi-factor authentication (MFA). Authentication answers: "Are you who you say you are?"

The process of verifying what a user can do. After authentication, authorization determines which pages, features, and data a user can access. Common patterns: RBAC (Role-Based Access Control), ABAC (Attribute-Based).

An HTTP header that tells the browser which resources (scripts, styles, images) are allowed to load. CSP prevents XSS (cross-site scripting) attacks by blocking unauthorized code execution.

A security mechanism that controls which domains can access your API. Without CORS, any website could make requests to your server. Proper CORS configuration prevents unauthorized data access.

Automated pipelines that test and deploy code. CI runs tests on every commit. CD deploys to production after tests pass. Reduces manual errors and speeds up delivery.

Google's metrics for measuring user experience: LCP (loading speed), INP (interactivity), and CLS (visual stability). Good Core Web Vitals improve search rankings and user retention.

An attack where traffic from many sources overwhelms a server, making it unavailable. Protection: rate limiting, CDN, Cloudflare, WAF.

Email authentication protocols that prevent email spoofing. SPF lists authorized senders. DKIM adds a digital signature. DMARC tells receiving servers what to do with emails that fail SPF/DKIM.

Google's quality guidelines for content. Content should demonstrate first-hand experience, subject matter expertise, authority in the field, and trustworthiness. Critical for SEO rankings.

EU privacy law governing how personal data is collected, stored, and used. Applies to any business serving EU residents. Fines up to €20M or 4% of global revenue.

A query language for APIs that lets clients request exactly the data they need. Unlike REST, GraphQL endpoints return flexible data structures. Reduces over-fetching and under-fetching.

An HTTP header that forces browsers to use HTTPS only. Prevents protocol downgrade attacks and cookie hijacking. Essential for any site handling sensitive data.

US law protecting patient health information (PHI). Applies to any entity that creates, receives, or transmits PHI. Requires technical, administrative, and physical safeguards.

A compact, URL-safe token format for securely transmitting information between parties. JWTs are commonly used for authentication — the server signs a token, and the client includes it in subsequent requests.

The simplest version of a product that delivers core value to early users. An MVP tests your hypothesis with minimal investment. Key: ship fast, learn fast, iterate.

A nonprofit foundation that produces security standards and tools. The OWASP Top 10 lists the most critical web application security risks (injection, broken auth, XSS, etc.).

Restricting how many requests a user can make in a given time period. Prevents brute force attacks, DDoS, and API abuse. Common: 100 requests per minute per IP.

A PostgreSQL feature that restricts which rows a user can access. Each query automatically filters data based on the user's role. Critical for multi-tenant applications.

Code added to web pages that helps search engines understand content structure. Implemented as JSON-LD. Enables rich results (star ratings, FAQs, pricing) in search listings.

The practice of improving website visibility in search engine results. Includes technical SEO (crawlability, speed), on-page SEO (content, keywords), and off-page SEO (backlinks, authority).

A compliance framework for service organizations that handle customer data. Based on five trust service criteria: security, availability, processing integrity, confidentiality, and privacy.

Rendering web pages on the server before sending to the browser. Faster initial load, better SEO, and works without JavaScript. Next.js supports SSR, SSG, and ISR.

Cryptographic protocols that encrypt data in transit between client and server. HTTPS uses TLS. Essential for protecting sensitive data and maintaining search rankings.

A superset of JavaScript that adds static type checking. Catches bugs at compile time instead of runtime. Improves code quality, developer experience, and maintainability.

A security layer that filters HTTP traffic between a web application and the internet. Blocks common attacks (SQL injection, XSS, DDoS) at the network edge.

An attack where malicious scripts are injected into web pages viewed by other users. Prevention: input validation, output encoding, CSP headers, sanitization libraries.