Blog

security

Veja todos os posts de security no blog do AtendePraMim.

Preventing SSRF in file uploads

SSRF — Server-Side Request Forgery — is the class of bug where your server makes an HTTP request on behalf of a user to a URL the user controls. The classic case: a profile-picture import feature that takes a URL and fetches the image. The attacker gives you http://169.254.169.254/ and suddenly your server is handing the cloud metadata endpoint to the…

ALAlexandre Awadallak

postsecurity

20 de fev.

Designing OAuth2 scopes

Scopes are the access-control language of your API. Get them right and third-party integrations feel natural. Get them wrong and you're forever explaining to customers why the Slack bot can also delete their billing history. At minimum, split every resource into read: and write:. read:cases lets an integration list cases; write:cases lets it mutate them.…

ALAlexandre Awadallak

postsecurity

15 de fev.

Session cookies vs JWTs

For browser-facing authentication, the debate between stateful sessions and stateless JWTs has had a clear answer for years. Session cookies win. The reasons are not exciting. A stateful session can be revoked in one UPDATE. A JWT cannot — the signature remains valid until the expiry you baked into the token, unless you build an allowlist or blocklist, at…

Preventing SSRF in file uploads

Designing OAuth2 scopes

Session cookies vs JWTs

Fique por dentro