Risposte dirette e definitive ai dubbi più comuni dell’ingegneria del software, senza giri di parole.
Sì, i token JSON Web Tokens standard (JWS) sono firmati, non cifrati. Header e payload sono semplici stringhe codificate in Base64URL che chiunque può decodificare e leggere in chiaro senza la chiave segreta.
Salvare i token di autenticazione nel localStorage li espone all’esfiltrazione immediata in caso di vulnerabilità Cross-Site Scripting (XSS). L’uso di cookie con attributi HttpOnly, Secure e SameSite impedisce l’accesso da parte di codice JavaScript malevolo.
Yes, the cryptographic signature of an expired JWT remains mathematically valid because signatures are computed solely over the header and payload data. However, compliant JWT libraries will reject the token during authentication because the expiration claim (`exp`) is explicitly checked after signature verification.
Authentication (AuthN) verifies who a user is (identity confirmation), while Authorization (AuthZ) determines what permissions or resources that authenticated user is allowed to access.
CORS allows standard GET requests without a preflight check for backward compatibility with the legacy web. Because HTML tags like `<form>`, `<img>`, and `<script>` have always been able to issue cross-origin GET requests without pre-approval, requiring preflights for all GETs would have broken decades of existing web architecture.
I browser inviano richieste preventive OPTIONS prima di richieste complesse (come quelle con header Authorization o Content-Type: application/json) per verificare che il server autorizzi il metodo e gli header prima di inviare dati che possono alterare lo stato.
Using 'unsafe-inline' in a Content Security Policy defeats XSS protection because it instructs the browser to execute any inline script found in the HTML. Since Cross-Site Scripting works by injecting malicious inline script tags or event handlers, 'unsafe-inline' allows the attacker's payload to run freely.
HTTP 401 Unauthorized means the user is not authenticated (identity unknown; credentials missing or invalid), whereas HTTP 403 Forbidden means the user is authenticated (identity known), but lacks the necessary permissions to access the requested resource.
Yes, HTTPS encrypts the entire HTTP request—including the URL path, query parameters, request headers, cookies, and message body. Only the destination hostname (domain name) and port number are visible on the wire via the TLS Server Name Indication (SNI) extension.
HTTP/2 multiplexes requests by splitting HTTP messages into independent binary frames tagged with a unique Stream ID. These frames are interleaved concurrently over a single shared TCP socket, eliminating the head-of-line blocking problem of HTTP/1.1.
Last-Modified is a timestamp-based cache validator with 1-second resolution, while ETag is an arbitrary content-based fingerprint (such as a hash) that accurately detects byte-level changes even when modifications occur multiple times in the same second or across distributed server clusters.
An HTTP method is idempotent if executing it multiple times produces the exact same server state as executing it once. PUT is idempotent because repeating a PUT replaces the target resource at a known URI, whereas repeating a POST creates additional new subordinate resources or appends duplicate records each time.
When a DNS record's Time-To-Live (TTL) expires, the recursive resolver purges or invalidates the cached record from its local memory. The next time a client queries that domain name, the resolver must issue a new query over the network to the authoritative nameserver to obtain fresh data.
No, a CNAME (Canonical Name) record cannot point to an IP address. RFC 1034 strictly mandates that a CNAME record must point exclusively to another fully qualified domain name (FQDN). To point a hostname directly to an IP address, you must use an A record (for IPv4) or an AAAA record (for IPv6).
A CNAME cannot exist at the zone apex (@ or example.com) because RFC 1034 mandates that if a CNAME exists at a node, no other record types may exist at that node. Because every zone apex is required to have SOA and NS records, an apex CNAME creates an irreconcilable protocol violation.
Changing a single character (or even a single bit) changes approximately 50% of the output SHA-256 hash digest because of the cryptographic Avalanche Effect. Secure hash algorithms use iterative rounds of bitwise rotations, non-linear boolean operations, and modular addition to diffuse input bits across the entire internal state.
MD5 is considered cryptographically broken because practical collision attacks exist that allow attackers to generate two completely different files with the exact same MD5 hash in a fraction of a second. Consequently, MD5 cannot be trusted for digital signatures, certificates, or file integrity verification.
Yes, reusing an Initialization Vector (IV) with the same AES-GCM key allows attackers to recover the plaintexts by XORing the ciphertexts together. Furthermore, IV reuse allows attackers to calculate the internal authentication subkey (H), enabling them to forge valid authentication tags and inject malicious data.
UUID v7 is significantly better for database primary keys because it begins with a 48-bit millisecond timestamp, making records sortable in chronological order. This preserves B-tree index locality and eliminates the severe page fragmentation and cache thrashing caused by completely random UUID v4 values.
Yes, Base64 encoding increases data size by approximately 33.3% (a 4:3 ratio). For every 3 bytes of raw binary data, Base64 produces 4 ASCII characters, plus up to 2 bytes of padding characters (`=`).