<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"><channel><title>OwlTheEngineer</title><description>Short, precise explanations of backend, system design and AI — the things that come up in interviews and break in production.</description><link>https://owltheengineer.com/</link><item><title>Cookie flags: HttpOnly, Secure, SameSite</title><link>https://owltheengineer.com/posts/cookie-flags/</link><guid isPermaLink="true">https://owltheengineer.com/posts/cookie-flags/</guid><description>Three attributes decide whether your cookie is sent at all. Here&apos;s what each one does, and why yours is missing.</description><pubDate>Sun, 30 Aug 2026 00:00:00 GMT</pubDate><category>cookies</category><category>security</category><category>auth</category><category>http</category></item><item><title>Sessions vs JWT: which one, and why</title><link>https://owltheengineer.com/posts/sessions-vs-jwt/</link><guid isPermaLink="true">https://owltheengineer.com/posts/sessions-vs-jwt/</guid><description>One is a pointer, the other is a copy. Almost every argument about them comes from missing that one line.</description><pubDate>Sat, 29 Aug 2026 00:00:00 GMT</pubDate><category>auth</category><category>security</category><category>jwt</category><category>sessions</category></item><item><title>What is an API, really?</title><link>https://owltheengineer.com/posts/what-is-an-api/</link><guid isPermaLink="true">https://owltheengineer.com/posts/what-is-an-api/</guid><description>Not the definition. The four things you actually send, what each one is for, and how to find the one that&apos;s wrong.</description><pubDate>Fri, 28 Aug 2026 00:00:00 GMT</pubDate><category>api</category><category>http</category><category>rest</category></item></channel></rss>