Blog

#security

Publicaciones etiquetadas con "security" en el blog de AtendePraMim.

Building SaaS Auth from Scratch

Authentication is the foundation of any SaaS application. In this post, we'll walk through how AtendePraMim implements session-based auth with iron-session, 2FA via TOTP, and magic links. We use iron-session with AES-256 encrypted HttpOnly cookies. No JWTs exposed to the browser. TOTP-based 2FA adds a second layer. The user scans a QR code with their…

ALAlexandre Awadallak

artículoengineering

25 mar

Webhook signing with HMAC

Webhooks are inbound HTTP requests from third parties. Without verification, anyone on the internet can POST to your webhook endpoint and trigger work. HMAC signing is how you verify the sender. When a provider sends a webhook, it computes an HMAC-SHA256 signature over the raw request body using a shared secret, then includes the result in a header…

ALAlexandre Awadallak

artículosecurity

28 feb

Preventing SSRF in file uploads

SSRF — Server-Side Request Forgery — is the class of bug where your server makes an HTTP request on behalf of a user to a URL the user controls. The classic case: a profile-picture import feature that takes a URL and fetches the image. The attacker gives you http://169.254.169.254/ and suddenly your server is handing the cloud metadata endpoint to the…

ALAlexandre Awadallak

artículosecurity

20 feb

Designing OAuth2 scopes

Scopes are the access-control language of your API. Get them right and third-party integrations feel natural. Get them wrong and you're forever explaining to customers why the Slack bot can also delete their billing history. At minimum, split every resource into read: and write:. read:cases lets an integration list cases; write:cases lets it mutate them.…

ALAlexandre Awadallak

Boletín

Mantente al día

Recibe nuevas publicaciones y entradas del changelog por correo o RSS.

RSSRSS del changelog