Archives for Software Dev - Page 3
Cross Site Scripting – Explained
Reflected XSS Explained Reflected Cross-Site Scripting (XSS) is a type of web vulnerability where untrusted input is immediately echoed (or "reflected") by the server in an HTTP response without…
How attackers can bypass CloudFlare
Also read CloudFlare and CORs Whitelisting Introduction To ensure that Origin Server denies all IPs except the CloudFlare IP (this will need to be AT the server level, not cloudlfare).…
Why are Root CAs often offline?
Root Certificate Authority Often a Standalone Server? 1. Ultimate Trust Anchor The Root CA is the trust anchor of the entire PKI hierarchy. If compromised, all subordinate certificates become untrustworthy.…
CSRF protection for APIs?
High Level Overview Cookie-authenticated APIs versus Authorization headers What Is CSRF Protection for API Endpoints? CSRF stands for Cross-Site Request Forgery. It’s a type of web attack where a malicious…
How Can a Hacker Abuse Poor CORS Configuration?
Basic High Level Flow The attacker hijacks your authentication credentials (your cookie) - and uses that to call a sensitive API. If the API is callable from 'all origins', then…
File Transfer versus APIs
API vs File Transfer: Choosing the Right Method for Data Exchange APIs and file transfers are both widely used methods for data exchange between systems. While they serve a similar…
What the heck is CORs? Can CloudFlare help me with CORs security issues?
Why CORS Is Important (And How to Secure It) Why CORS Is Important (And How to Secure It) What is CORS and why is it important? CORS (Cross-Origin Resource Sharing)…
Session-based vs Token-based Authentication
Session-based vs Token-based Authentication - Q and A Q: Aren’t session-based and token-based authentication basically the same? At first glance, they do appear similar: You authenticate with a service. The…
Strict HTTP Transport Not Enforced
Strict Transport Security Not Enforced What Is HSTS? HSTS (HTTP Strict Transport Security) is a browser-enforced policy that ensures a website is only accessed using HTTPS—even if a user…
Preventing CORS – Server Explicitly Sets CORS Headers for an HTTP Request versus CloudFlare
How a Server Explicitly Sets CORS Headers for an HTTP Request A server explicitly sets CORS headers by including them in the HTTP response to a cross-origin request. These headers…