Blog

security

Explora todas las publicaciones de security en el blog de AtendePraMim.

Preventing SSRF in file uploads

SSRF — Server-Side Request Forgery — is the class of bug where your server makes an HTTP request on behalf of a user to a URL the user controls. The classic case: a profile-picture import feature that takes a URL and fetches the image. The attacker gives you http://169.254.169.254/ and suddenly your server is handing the cloud metadata endpoint to the…

ALAlexandre Awadallak

artículosecurity

20 feb

Designing OAuth2 scopes

Scopes are the access-control language of your API. Get them right and third-party integrations feel natural. Get them wrong and you're forever explaining to customers why the Slack bot can also delete their billing history. At minimum, split every resource into read: and write:. read:cases lets an integration list cases; write:cases lets it mutate them.…

ALAlexandre Awadallak

artículosecurity

15 feb

Session cookies vs JWTs

For browser-facing authentication, the debate between stateful sessions and stateless JWTs has had a clear answer for years. Session cookies win. The reasons are not exciting. A stateful session can be revoked in one UPDATE. A JWT cannot — the signature remains valid until the expiry you baked into the token, unless you build an allowlist or blocklist, at…

ALAlexandre Awadallak

Boletín

Mantente al día

Recibe nuevas publicaciones y entradas del changelog por correo o RSS.

RSSRSS del changelog