API Security
-
Application Security
Decoding a JWT Is Not the Same as Verifying One
A JSON Web Token is base64 text anyone can read and edit. Trusting its claims without checking the signature and…
Read More » -
Application Security
The API Vulnerability Scanners Cannot Find: Broken Object Authorization
Changing an ID in a request and receiving someone else's data is the most common serious API flaw. It requires…
Read More » -
Application Security
Mass Assignment Lets Users Set Fields You Never Exposed
Binding a request body directly to a model means any field in that model is writable, including the ones controlling…
Read More »