Cookie flags: HttpOnly, Secure, SameSite
Three attributes decide whether your cookie is sent at all. Here's what each one does, and why yours is missing.
Backend
3 articles in this pillar.
Sessions vs JWT: which one, and why
One is a pointer, the other is a copy. Almost every argument about them comes from missing that one line.
What is an API, really?
Not the definition. The four things you actually send, what each one is for, and how to find the one that's wrong.