# 06 - Security as an Architectural Priority

JWT authentication with HttpOnly cookies, refresh token rotation, 2-level RBAC, rate limiting, BCrypt and OWASP Top 10 compliance in Play The Event.

## What you'll learn

- JWT authentication with HttpOnly cookies (why not localStorage)
- Stateless session management and its trade-offs
- Token rotation and refresh token strategy
- Role-Based Access Control (RBAC) implementation
- Security headers and CORS configuration

*This article is part of the **Play the Event** series on federicocalo.dev.*

---

## Read the full article

The complete article (14 min read) with code examples, diagrams, and practical exercises is available here:

**➡️ [06 - Security as an Architectural Priority](https://federicocalo.dev/en/blog/pte-security-jwt-rbac-owasp)**

`https://federicocalo.dev/en/blog/pte-security-jwt-rbac-owasp`

---

*By [Federico Calò](https://federicocalo.dev) — Software Developer & Technical Writer*