Tag: security Basic
This content is a draft and will not be included in production builds.
17 articles tagged security:
- BOLA/IDOR: logged in, yet able to read someone else's order
- Common API mistakes: injection, authorization, secrets, retries
- CORS and CSRF: blocking the read of a response is not blocking the request
- Dockerfiles for Node.js: multi-stage, layer cache and running non-root
- OAuth 2.0, OIDC and PKCE: signing in through an identity provider without leaking the code or the token
- Ordering: a correct OAuth Authorization Code + PKCE login
- Password hashing: why does salted sha256 still break when the database leaks?
- Rate limiting for APIs: picking an algorithm, where to keep state and how to reject
- Row-level security for multi-tenancy: one shared schema, no cross-tenant reads
- Scenario: a customer sees another company's invoices
- Scenario: an admin token leaks
- Scenario: an API leaks other customers' orders
- Secrets in Git, PR size and a review checklist
- Secure coding for backends: the vulnerabilities live in the code you write
- Session cookie or JWT: choosing an authentication mechanism for the backend
- SSRF: when an API fetches a client-supplied URL
- Webhooks: verifying signatures, handling retries and preventing duplicate processing