Writing
api security
7 articles on this subject.
Mass assignment: when the framework writes the fields you never meant to expose
Mass assignment is the binding mechanism behind a whole class of privilege-escalation bugs: the framework copies every key in the request body onto your object, including the ones you never put in the form. Here is how it differs from the BOPLA authorisation question, the real CVEs, a lab, and the allowlist that ends it.
8 min read
No 'Access-Control-Allow-Origin' header is present on the requested resource: the error is right, and both popular fixes are vulnerabilities
No 'Access-Control-Allow-Origin' header is present on the requested resource. The two fixes developers copy do not fix CORS, they delete it. One is account takeover.
13 min read
Race conditions are not hard any more: the single-packet attack and what it broke
Web race conditions were dismissed as theoretical because network jitter made the window unhittable. Then HTTP/2 removed the jitter. The technique, the sub-states nobody models, and how to build code that cannot race.
7 min read
JWT: alg confusion, kid injection, and the day Java accepted a signature of zero
A JSON Web Token is only as good as the verification code. Five failure modes with concrete examples, including CVE-2022-21449, where an all-zero ECDSA signature validated against any key on Java 15 through 18.
9 min read
Shadow APIs: the v1 endpoint nobody remembered to switch off
Every API inventory is a snapshot of what someone remembered to document. The gap between that list and what your servers actually answer is where breaches live, how to find zombie, shadow and orphaned endpoints, and how to stop creating them.
9 min read
GraphQL has no authorisation layer: aliases, batching, and the resolvers everyone forgets
GraphQL moves authorisation from the route to the resolver, and most teams only notice half of them. Introspection, alias multiplication, batched mutations against rate limits, and the complexity-DoS CVEs, with the fixes that actually hold.
8 min read
BOLA, BFLA, BOPLA: the three authorisation bugs no scanner will find for you
Optus lost roughly 10 million customer records to an API with sequential IDs and no authorisation check. Here is how to tell the three authorisation failures apart, how to test each one, and why automated tools are structurally blind to them.
7 min read