Web security, authentication, and secure coding practices
94 posts
For traditional web and mobile applications, the OAuth 2.0 authorization code flow is the gold standard for secure authentication. However, this standard paradigm hits a significant wall when applied to "no-keyboard" or "limited-input" devices. Imagine trying to enter a 64-character alphanumeric ...
Despite being one of the oldest vulnerabilities in the OWASP Top Ten, Cross-Site Scripting (XSS) remains a persistent threat vector for modern web applications. For intermediate to advanced developers, moving beyond basic knowledge is crucial. We must understand not just how to sanitize input, bu...
In the modern DevOps landscape, security cannot be an afterthought. As development teams shift left, integrating security testing directly into the Continuous Integration and Continuous Deployment (CI/CD) pipeline has become a critical requirement. However, simply plugging in tools is not enough;...
Introduction: The New Attack Surface In the era of Agile and DevOps, Continuous Integration and Continuous Deployment (CI/CD) pipelines have become the backbone of software delivery. However, as we accelerate the pace of deployment, we often inadvertently expand our attack surface. Supply chain ...
In the modern software development landscape, the Continuous Integration/Continuous Deployment (CI/CD) pipeline is the backbone of delivery speed and quality. However, as organizations accelerate their deployment cycles, the attack surface expands. CI/CD pipelines have emerged as high-value targe...
In the modern software ecosystem, APIs (Application Programming Interfaces) are the backbone of communication between services. Whether you are building a microservices architecture, exposing a public REST API, or creating a GraphQL endpoint, the attack surface is constantly expanding. A single v...
Server-Side Request Forgery (SSRF) remains one of the most critical yet frequently overlooked vulnerabilities in modern application development. While traditional SSRF allowed attackers to probe internal networks, the rise of cloud-native technologies has shifted the attack surface. Today, the pr...