Web Security
39 articles
Web security defends applications against the attacks that dominate real-world breaches. These guides explain the OWASP Top 10, injection and access-control flaws, secure coding practices, and the framework defenses that prevent XSS, SQL injection, and SSRF.
API Security Best Practices: Building the Defensive Program
How to secure an API end to end: inventory of shadow and zombie endpoints, token validation, where authorization decisions live, schema enforcement, rate-limit budgets, gateway placement, and the logs that catch what you missed.
Input Validation Best Practices: Allowlists, Canonicalization & Encoding
How to build input validation that holds: allowlist rules by field, canonicalize before you check, and encode at the sink. With the failure modes that quietly defeat each one.
API Rate Limiting: Algorithms, Keys, and 429s
How API rate limiting works: token bucket, leaky bucket and sliding window algorithms, what key to count on, where to enforce, and the failure modes that make a limiter decorative.
API Abuse: BOLA, BFLA, and Excessive Data Exposure
How API abuse works through the OWASP API Top 10: broken object and function level authorization, excessive data exposure, and rate-limit defense.
Clickjacking: UI Redress Attacks & Frame Defenses
How clickjacking hijacks a user's clicks with transparent iframes, what an attacker can trigger, and how to block framing with headers and CSP.
Command Injection: Shell Metacharacters & Safe APIs
How OS command injection breaks out of an intended command via shell metacharacters, and why argument-array APIs beat string concatenation.
Content Security Policy: Stopping XSS with CSP
How Content Security Policy works: the directives that matter, how it blocks XSS and injection, nonces vs hashes, and a safe report-only rollout.
CORS: The Same-Origin Policy & How to Relax It
How the same-origin policy protects users, how CORS shares responses across origins, preflight and credentials, and how to configure it safely.
CORS Misconfiguration: When Permissive Origins Leak Data
How CORS misconfigurations expose data: reflected origins with credentials, null and wildcard traps, and how to build a safe cross-origin policy.
CSRF: SameSite Cookies & Anti-CSRF Tokens
How cross-site request forgery rides a logged-in user's cookies to force state-changing requests, and how SameSite, tokens, and double-submit stop it.
GraphQL Attacks: Introspection, Nested Queries & Batching
How GraphQL gets attacked: exposed introspection, deeply nested query denial of service, batching abuse, and defending with depth and cost limits.
Host Header Injection: Reset Poisoning & Cache Attacks
How attackers abuse the HTTP Host header for password-reset poisoning, cache issues, and routing tricks, why it happens, and how to defend against it.
HTTP Request Smuggling: Front-End/Back-End Desync
How HTTP request smuggling exploits parsing disagreements between front-end and back-end servers, the CL.TE and TE.CL variants, and how to defend.
HTTP Security Headers: What Each Does & the Value to Set
A defensive reference to HTTP security response headers: what each one does, a recommended value, and the attack it mitigates, from CSP to Cache-Control.
IDOR: Insecure Direct Object References
What IDOR is, how missing authorization on object IDs leaks or changes other users' data, why guessable IDs are not the real cause, and how to defend.
Insecure Deserialization: Object Injection & Gadget Chains
Why deserializing untrusted data is dangerous, how gadget chains turn it into remote code execution, and safer serialization alternatives.
JWT Attacks: alg=none, Algorithm Confusion & Weak Secrets
How JSON Web Token attacks work: the alg=none trick, RS256-to-HS256 algorithm confusion, brute-forcing weak secrets, and how to defend.
LDAP Injection: Filter Manipulation & Auth Bypass
How LDAP injection lets attackers rewrite directory search filters to bypass logins and read data, why it happens, and how to bind and query safely.
Mass Assignment: Binding Untrusted Fields to Your Objects
How mass assignment lets attackers set fields you never meant to expose, why auto-binding is the cause, and how allowlists and DTOs shut it down.
NoSQL Injection: Operator Injection in Document Databases
How NoSQL injection works in document and query databases, operator injection, authentication bypass, blind extraction, and how parameterization stops it.
OAuth Attacks: redirect_uri Manipulation, Codes & CSRF
How OAuth 2.0 attacks work: redirect_uri manipulation, stolen authorization codes, CSRF on the login flow, and how PKCE defends it.
Open Redirect: How Unvalidated Redirects Launder Phishing
How open redirects let attackers borrow your domain's trust to send victims to malicious sites, why filters fail, and how an allowlist stops it.
Passkeys: Phishing-Resistant Passwordless Login
What passkeys are, how they log you in without a password, why they resist phishing, and where adoption stands, in plain language.
Path Traversal: Directory Traversal, LFI & Canonicalization
How ../ sequences escape an intended directory to read arbitrary files, why canonicalization matters, and how allowlists stop path traversal.
Prototype Pollution: Poisoning JavaScript Objects
How prototype pollution works in JavaScript: injecting into __proto__, gadget-driven escalation to DoS, bypasses and RCE, and how to shut it down.
SAML vs OAuth vs OIDC: Three Identity Protocols
How SAML, OAuth 2.0, and OpenID Connect differ, what each one actually does, and which to reach for when you build SSO or authorize an API.
Server-Side Template Injection: From Templates to RCE
How SSTI works: user input reaching template engines, detecting the flaw, sandbox escapes to remote code execution, and how to template safely.
Session Fixation: Forcing a Known Session ID
How session fixation works: an attacker plants a session ID, the victim logs in with it, and the attacker inherits the session. Plus the fix.
Session Hijacking: Stealing & Replaying Session Tokens
How session hijacking works: cookie theft, XSS-to-session takeover, token replay, and the defenses that keep a stolen session unusable.
SPF, DKIM, and DMARC: Stopping Email Spoofing
How the three email authentication standards work together to stop spoofing, what each one checks, and how to set them up without breaking your mail.
SSRF: Server-Side Request Forgery & Cloud Metadata
How server-side request forgery works, why it's so dangerous in the cloud, basic vs blind SSRF, real impact like stealing cloud credentials, and how to defend.
Web Cache Poisoning: Cache Keys, Unkeyed Inputs & Defense
How web cache poisoning turns a shared cache into a delivery system for attacker content by abusing unkeyed inputs, and how to defend the cache key.
WebAuthn: The FIDO2 Standard Behind Passkeys
How WebAuthn and FIDO2 work: authenticators, the sign-in ceremonies, attestation, and the roles behind passwordless login.
JWT: JSON Web Tokens
A plain guide to JSON Web Tokens: the header, payload, and signature, how stateless auth works, what the parts mean, and the pitfalls that bite teams.
XXE Injection: XML External Entities, File Disclosure & SSRF
How XML external entity injection reads local files, triggers SSRF, and crashes parsers, plus how disabling DTDs and external entities stops it.
OWASP Top 10 Explained with Examples
A practical breakdown of the OWASP Top 10 (2021) with real vulnerability examples, payloads, and fixes every developer and pentester should know.
Secure Coding Practices Every Developer Should Know
Most vulnerabilities come from code. The secure coding principles that prevent injection, auth flaws and data exposure, with examples in multiple languages.
SQL Injection: How It Works and How to Stop It
SQL injection has topped the web vulnerability list for decades. How attackers exploit it, real payload examples, and the defenses that actually work.
Cross-Site Scripting (XSS): Attack Types and Prevention
XSS is the most common web vulnerability. Learn how reflected, stored, and DOM-based XSS work, see real payloads, and understand the defenses that stop them.