Web Security
37 articles
Web security defends applications against the attacks that dominate real-world breaches. These guides explain the OWASP Top 10, injection and access-control flaws, secure coding practices, and the framework defenses that prevent XSS, SQL injection, and SSRF.
API Abuse Explained: BOLA, BFLA, and Excessive Data Exposure
How API abuse works through the OWASP API Top 10: broken object and function level authorization, excessive data exposure, and rate-limit defense.
Clickjacking Explained: UI Redress Attacks & Frame Defenses
How clickjacking hijacks a user's clicks with transparent iframes, what an attacker can trigger, and how to block framing with headers and CSP.
Command Injection: Shell Metacharacters & Safe APIs
How OS command injection breaks out of an intended command via shell metacharacters, and why argument-array APIs beat string concatenation.
Content Security Policy Explained: Stopping XSS with CSP
How Content Security Policy works: the directives that matter, how it blocks XSS and injection, nonces vs hashes, and a safe report-only rollout.
CORS Explained: The Same-Origin Policy & How to Relax It
How the same-origin policy protects users, how CORS shares responses across origins, preflight and credentials, and how to configure it safely.
CORS Misconfiguration: When Permissive Origins Leak Data
How CORS misconfigurations expose data: reflected origins with credentials, null and wildcard traps, and how to build a safe cross-origin policy.
CSRF Explained: SameSite Cookies & Anti-CSRF Tokens
How cross-site request forgery rides a logged-in user's cookies to force state-changing requests, and how SameSite, tokens, and double-submit stop it.
GraphQL Attacks: Introspection, Nested Queries & Batching
How GraphQL gets attacked: exposed introspection, deeply nested query denial of service, batching abuse, and defending with depth and cost limits.
Host Header Injection: Reset Poisoning & Cache Attacks
How attackers abuse the HTTP Host header for password-reset poisoning, cache issues, and routing tricks, why it happens, and how to defend against it.
HTTP Request Smuggling: Front-End/Back-End Desync
How HTTP request smuggling exploits parsing disagreements between front-end and back-end servers, the CL.TE and TE.CL variants, and how to defend.
HTTP Security Headers: What Each Does & the Value to Set
A defensive reference to HTTP security response headers: what each one does, a recommended value, and the attack it mitigates, from CSP to Cache-Control.
IDOR Explained: Insecure Direct Object References
What IDOR is, how missing authorization on object IDs leaks or changes other users' data, why guessable IDs are not the real cause, and how to defend.
Insecure Deserialization: Object Injection & Gadget Chains
Why deserializing untrusted data is dangerous, how gadget chains turn it into remote code execution, and safer serialization alternatives.
JWT Attacks: alg=none, Algorithm Confusion & Weak Secrets
How JSON Web Token attacks work: the alg=none trick, RS256-to-HS256 algorithm confusion, brute-forcing weak secrets, and how to defend.
LDAP Injection: Filter Manipulation & Auth Bypass
How LDAP injection lets attackers rewrite directory search filters to bypass logins and read data, why it happens, and how to bind and query safely.
Mass Assignment: Binding Untrusted Fields to Your Objects
How mass assignment lets attackers set fields you never meant to expose, why auto-binding is the cause, and how allowlists and DTOs shut it down.
NoSQL Injection: Operator Injection in Document Databases
How NoSQL injection works in document and query databases, operator injection, authentication bypass, blind extraction, and how parameterization stops it.
OAuth Attacks: redirect_uri Manipulation, Codes & CSRF
How OAuth 2.0 attacks work: redirect_uri manipulation, stolen authorization codes, CSRF on the login flow, and how PKCE defends it.
Open Redirect: How Unvalidated Redirects Launder Phishing
How open redirects let attackers borrow your domain's trust to send victims to malicious sites, why filters fail, and how an allowlist stops it.
Passkeys Explained: Phishing-Resistant Passwordless Login
What passkeys are, how they log you in without a password, why they resist phishing, and where adoption stands, in plain language.
Path Traversal: Directory Traversal, LFI & Canonicalization
How ../ sequences escape an intended directory to read arbitrary files, why canonicalization matters, and how allowlists stop path traversal.
Prototype Pollution Explained: Poisoning JavaScript Objects
How prototype pollution works in JavaScript: injecting into __proto__, gadget-driven escalation to DoS, bypasses and RCE, and how to shut it down.
SAML vs OAuth vs OIDC: Three Identity Protocols Explained
How SAML, OAuth 2.0, and OpenID Connect differ, what each one actually does, and which to reach for when you build SSO or authorize an API.
Server-Side Template Injection: From Templates to RCE
How SSTI works: user input reaching template engines, detecting the flaw, sandbox escapes to remote code execution, and how to template safely.
Session Fixation Explained: Forcing a Known Session ID
How session fixation works: an attacker plants a session ID, the victim logs in with it, and the attacker inherits the session. Plus the fix.
Session Hijacking: Stealing & Replaying Session Tokens
How session hijacking works: cookie theft, XSS-to-session takeover, token replay, and the defenses that keep a stolen session unusable.
SPF, DKIM, and DMARC Explained: Stopping Email Spoofing
How the three email authentication standards work together to stop spoofing, what each one checks, and how to set them up without breaking your mail.
SSRF Explained: Server-Side Request Forgery & Cloud Metadata
How server-side request forgery works, why it's so dangerous in the cloud, basic vs blind SSRF, real impact like stealing cloud credentials, and how to defend.
Web Cache Poisoning: Cache Keys, Unkeyed Inputs & Defense
How web cache poisoning turns a shared cache into a delivery system for attacker content by abusing unkeyed inputs, and how to defend the cache key.
Web Race Conditions: TOCTOU & Limit-Overrun Attacks
How web race conditions cause TOCTOU and limit-overrun exploits, why concurrent requests beat single-use checks, and how locking and idempotency defend.
WebAuthn Explained: The FIDO2 Standard Behind Passkeys
How WebAuthn and FIDO2 work: authenticators, the sign-in ceremonies, attestation, and the roles behind passwordless login.
What Is a JWT? JSON Web Tokens Explained
A plain guide to JSON Web Tokens: the header, payload, and signature, how stateless auth works, what the parts mean, and the pitfalls that bite teams.
XXE Injection: XML External Entities, File Disclosure & SSRF
How XML external entity injection reads local files, triggers SSRF, and crashes parsers, plus how disabling DTDs and external entities stops it.
OWASP Top 10 Explained with Examples
A practical breakdown of the OWASP Top 10 (2021) with real vulnerability examples, payloads, and fixes every developer and pentester should know.
Secure Coding Practices Every Developer Should Know
Most vulnerabilities come from code. The secure coding principles that prevent injection, auth flaws and data exposure, with examples in multiple languages.
SQL Injection Explained: How It Works and How to Stop It
SQL injection has topped the web vulnerability list for decades. How attackers exploit it, real payload examples, and the defenses that actually work.
Cross-Site Scripting (XSS): Attack Types and Prevention
XSS is the most common web vulnerability. Learn how reflected, stored, and DOM-based XSS work, see real payloads, and understand the defenses that stop them.