Writing
authorization
8 articles on this subject.
Mass assignment: when the framework writes the fields you never meant to expose
Mass assignment is the binding mechanism behind a whole class of privilege-escalation bugs: the framework copies every key in the request body onto your object, including the ones you never put in the form. Here is how it differs from the BOPLA authorisation question, the real CVEs, a lab, and the allowlist that ends it.
8 min read
redirect_uri and the PKCE downgrade: two OAuth checks that fail open
OAuth redirect_uri validation and PKCE are two separate defences, and both fail the same way: they permit what they should refuse. Here is how loose redirect matching and a dropped code_challenge each hand an authorization code to an attacker, with the real CVEs, a lab, and the exact server-side checks that close them.
9 min read
No 'Access-Control-Allow-Origin' header is present on the requested resource: the error is right, and both popular fixes are vulnerabilities
No 'Access-Control-Allow-Origin' header is present on the requested resource. The two fixes developers copy do not fix CORS, they delete it. One is account takeover.
13 min read
Non-human identity: 109 machine accounts per human, and the offboarding process that never runs
Service accounts, API keys, OAuth grants and CI/CD secrets hold broader access and longer-lived credentials than any employee would be permitted to carry, and none of them appear in an access review. Inventory, short-lived tokens, and the IAM calls that give the game away.
8 min read
JWT: alg confusion, kid injection, and the day Java accepted a signature of zero
A JSON Web Token is only as good as the verification code. Five failure modes with concrete examples, including CVE-2022-21449, where an all-zero ECDSA signature validated against any key on Java 15 through 18.
9 min read
Shadow APIs: the v1 endpoint nobody remembered to switch off
Every API inventory is a snapshot of what someone remembered to document. The gap between that list and what your servers actually answer is where breaches live, how to find zombie, shadow and orphaned endpoints, and how to stop creating them.
9 min read
GraphQL has no authorisation layer: aliases, batching, and the resolvers everyone forgets
GraphQL moves authorisation from the route to the resolver, and most teams only notice half of them. Introspection, alias multiplication, batched mutations against rate limits, and the complexity-DoS CVEs, with the fixes that actually hold.
8 min read
BOLA, BFLA, BOPLA: the three authorisation bugs no scanner will find for you
Optus lost roughly 10 million customer records to an API with sequential IDs and no authorisation check. Here is how to tell the three authorisation failures apart, how to test each one, and why automated tools are structurally blind to them.
7 min read