The engineering questions you get asked, and the bugs you actually hit. Drawn, one mechanism at a time, in the order the videos ship.
401 means 'I don't know who you are (authenticate yourself)'. 403 means 'I know who you are, and you don't have permission'. The naming mistake in HTTP and how to use them.
Encryption is a two-way street with a key. Hashing is a one-way mathematical trapdoor. Why speed is the enemy of secure passwords.
The padlock proves the line is private and the name is real, and has never had an opinion about whether the site is honest — which is why a phishing page gets exactly the same one.
A bearer token can't be recalled, so the only way to bound the damage is to bound the time. Everything else — the split, the 401, the rotation — falls out of that one sentence.
Three parties, one redirect, and a code traded for a token. The whole protocol is visible in your address bar, and nobody ever tells you to look.
Three attributes decide whether your cookie is sent at all. Here's what each one does, and why yours is missing.
One is a pointer, the other is a copy. Almost every argument about them comes from missing that one line.
