Blog
Browse all security posts on the AtendePraMim blog.
SSRF — Server-Side Request Forgery — is the class of bug where your server makes an HTTP request on behalf of a user to a URL the user controls. The classic case: a profile-picture import feature that takes a URL and fetches the image. The attacker gives you http://169.254.169.254/ and suddenly your server is handing the cloud metadata endpoint to the…
Scopes are the access-control language of your API. Get them right and third-party integrations feel natural. Get them wrong and you're forever explaining to customers why the Slack bot can also delete their billing history. At minimum, split every resource into read: and write:. read:cases lets an integration list cases; write:cases lets it mutate them.…
For browser-facing authentication, the debate between stateful sessions and stateless JWTs has had a clear answer for years. Session cookies win. The reasons are not exciting. A stateful session can be revoked in one UPDATE. A JWT cannot — the signature remains valid until the expiry you baked into the token, unless you build an allowlist or blocklist, at…
Newsletter
Get new posts and changelog entries by email or RSS.