How to Prevent Session Hijacking: Secure PHP Session Management
A user logs in. Your app hands them a session ID. From that moment on, that little string is the only
Web Application Security
Understanding PHP Deserialization Vulnerabilities and Preventing Remote Code Execution
A single line, unserialize($_GET[‘data’]), has handed attackers full control of more servers than most developers would like to admit. It looks
Understanding and Preventing XSS Attacks in JavaScript Applications
One malicious string in the wrong text box, and an attacker is running code inside your users’ browsers, on your domain,
Securing Meta Tags: Preventing Clickjacking, XSS, and Other Vulnerabilities
You drop a meta tag into your <head>, and something in your brain relaxes. Security handled. Move on. That feeling is
Defending Against Content Security Policy (CSP) Bypass: Best Practices for JavaScript Applications
You ship a Content Security Policy, see the header show up in DevTools, and feel safe. That feeling is the trap.
30 Days of JavaScript: Web Security and JavaScript, Day 29
One unescaped string is all it takes. A comment box, a search field, a URL parameter, someone drops a <script> tag