Authorisation
-
Application Security
Mass Assignment Lets Users Set Fields You Never Exposed
Binding a request body directly to a model means any field in that model is writable, including the ones controlling…
Read More » -
Identity & Access
OAuth Consent Screens Ask for More Than Applications Need
A calendar plugin requesting full mailbox access is normal, and the user clicking accept has no way to grant less.
Read More »