Web Developer Dictionary

OAuth 2.0 is an authorisation protocol that lets an application obtain limited access to a user's resources on another service — without sharing the user's password. "Sign in with Google" is OAuth 2.0.Main rolesResource Owner — the user who owns the dataClient — your application requesting accessAuthorization Server — the server (Google, GitHub) that issues tokensResource Server — the API that holds the user's dataFlows (Grant Types)Authorization Code + PKCE — most secure; for web and mobile appsClient Credentials — for machine-to-machine communication (no user involved)Implicit — deprecated, not recommendedOAuth vs OpenID ConnectOAuth 2.0 provides authorisation (access to a resource). OpenID Connect (OIDC) is a layer on top of OAuth that adds authentication (who you are). OIDC returns an ID Token (JWT) containing user data.

Observer is a pattern where a subject object maintains a list of dependent observer objects and automatically notifies them when its state changes. It is the foundation of event systems.ParticipantsSubject (Publisher) — maintains the observer list; provides subscribe / unsubscribe / notify methodsObserver (Subscriber) — implements an update() method called by the subjectWhere it appearsDOM events in the browser (addEventListener)Event systems in frameworks (EventEmitter in Node.js)Reactive Programming (RxJS Observable)In-application message busObserver vs Pub/SubIn Observer, the subject knows its observers directly. In Pub/Sub there is a broker between them: publisher and subscriber are unaware of each other.

OPcache is a built-in PHP extension that stores compiled bytecode in shared memory. Instead of parsing and compiling the same file on every request, PHP does it once — then reads the result from memory. The typical gain is 2–5× higher throughput with zero changes to your code.How it worksThe first time PHP executes a script, it compiles the source into bytecode (opcodes) and writes it to shared memory. All subsequent requests — even from different worker processes — read the pre-compiled bytecode directly, bypassing the lexer, parser, and compiler entirely.Key directivesopcache.enable = 1 — enables the extension (on by default in most distributions)opcache.memory_consumption = 128 — shared memory size in MB; use 256+ for large projectsopcache.max_accelerated_files = 10000 — maximum number of files in the cacheopcache.validate_timestamps = 0 — disables file modification checks; essential for production, yields the biggest speed boostopcache.revalidate_freq = 60 — when validate_timestamps = 1, recheck files every N secondsCache invalidationIn production with validate_timestamps = 0, OPcache is unaware of file changes. After a deploy you must flush it manually. The cleanest approach is restarting PHP-FPM. When that is not an option, call opcache_reset() or opcache_invalidate($path, true) from a post-deploy script.

An open redirect is a vulnerability where an application redirects a user to an arbitrary external URL without validation. An attacker crafts a link like https://trusted.com/redirect?url=https://phishing.com — the victim sees a trusted domain and lands on a malicious site. Typical use in attacks Phishing — the link looks trustworthy OAuth redirect hijacking — substitute the redirect_uri in an OAuth flow Bypassing referer checks Defence Whitelist allowed URLs or domains for redirection Do not accept external URLs in redirect parameters Compare the URL host with the current domain before redirecting // Check: only relative URLs function safeRedirect(string $url): string { $parsed = parse_url($url); // reject if scheme or host is present if (isset($parsed['scheme']) || isset($parsed['host'])) { return '/'; // fallback to home } return $url; }

OpenAPI is a standard for machine-readable REST API descriptions in YAML or JSON format. Swagger is the toolset built around this standard (Swagger UI, Swagger Editor). Documentation that never goes stale — generated from code or used as the source of truth for code generation.What it providesInteractive documentation (Swagger UI) — test endpoints directly in the browserClient SDK generation — automatic TypeScript/Python/PHP client from the API descriptionRequest and response validation against the specificationA contract between frontend and backend — describe the API first, then implement itMinimal examplepaths: /users/{id}: get: summary: Get user parameters: - name: id in: path required: true schema: type: integer

ORM (Object-Relational Mapping) is a layer between your code and the database that lets you work with tables as objects. Instead of writing SQL queries, you work with classes and methods, and the ORM generates SQL for you.Benefits and costORM speeds up development, protects against SQL injection, and makes it easy to switch databases. The cost: overhead and the risk of inefficient queries. The classic example is the N+1 problem, where ORM fires a separate query per record instead of one JOIN.Two patternsActive Record — the model knows how to save itself. Code looks like $user->save(). Simpler, but tightly couples the model to persistenceData Mapper — the model and persistence logic are separated into a dedicated class (Repository/Mapper). More complex, but more flexible for large projects

OWASP (Open Web Application Security Project) is a non-profit organisation publishing web security standards. The OWASP Top 10 is an annual list of the most common vulnerabilities — the de facto standard for application security audits.Top 10 (2021)Broken Access Control — accessing other users' dataCryptographic Failures — weak encryption, password leaksInjection — SQL, NoSQL, OS, LDAP injectionInsecure Design — architectural-level flawsSecurity Misconfiguration — default passwords, open portsVulnerable Components — outdated dependencies with known vulnerabilitiesAuthentication Failures — weak authenticationSoftware Integrity Failures — insecure CI/CD, unverified updatesLogging Failures — no monitoring of attacksSSRF — Server-Side Request Forgery