Key security concepts senior backend engineers must know cold

A technical guide outlines the security instincts and knowledge expected of senior backend engineers during interviews, focusing on real-world vulnerabilities rather than textbook definitions. A core distinction highlighted is between authentication and authorisation bugs, with the latter being far more common since access decisions must be enforced at every endpoint, not just at login. Password storage best practices favour deliberately slow, memory-hard algorithms like bcrypt or argon2, with per-user salts and constant-time failure paths to prevent timing-based account enumeration. On token-based authentication, the guide recommends short-lived access tokens paired with refresh tokens, with the JWT algorithm pinned server-side and tokens stored in httpOnly cookies to limit script access. SQL injection defence is framed not as input escaping but as structural separation, using parameterised queries so user input is never parsed as part of a SQL statement.