Posts tagged #appsec on Dynamo Geeks: 4 posts from the community, most useful first.
password reset tokens checklist: random from a CSPRNG, single use, expire in 15-60 min, store only a hash, invalidate on password change, same response whether the email exists or not. most bugs i find are the last one
Last quarter an external pentest found that any logged-in customer could download any other customer's account statement. It took the tester around 10 minutes. I want to share it because the bug was very ordinary, and ordinary bugs are the ones that survive reviews. The endpoint was GET /api/statements/{id} . It checked that the request had a valid session. It did not check that the statement belonged to the…
This question comes up in every code review I do for a new web app, so I am writing the long answer once. The short version For a first-party web app (your frontend talks to your own API): keep the session in an HttpOnly, Secure, SameSite cookie , and do not put long-lived tokens anywhere JavaScript can read them. If you must use OAuth access tokens in the browser, keep the access token in memory and short-lived,…
Threat modelling has a reputation for being a heavy process with special tools and a 40 page document nobody reads. It does not have to be. For most features, a 45 minute session with the people who built it finds the important problems. This is the format I use with product teams at the bank. Before the session (10 minutes, one person) Draw the data flow on one page. Boxes for components, arrows for data, and…
