#security
Application security: authentication, authorization, secrets, headers and common vulnerabilities.
Posts tagged #security
password reset tokens checklist: random from a CSPRNG…
password reset tokens checklist: random from a CSPRNG, single use, expire in 15-60 min, store only a hash, invalidate on password change, same response whether the email exists or not. most bugs i find are the last one
How does your team handle secrets in CI?
A pentester found an IDOR in our statements API in 10 minutes. The fix was boring
Last quarter an external pentest found that any logged-in customer could download any other customer's account statement. It took the tester around 10 minutes. I want to share it because the bug was very ordinary, and ordinary bugs are the ones that survive reviews. The endpoint was GET /api/statements/{id} . It checked that the request had a valid session. It did not check that the statement belonged to the…
Pseudonymisation is not anonymisation: a note for people building health apps in the EU
I review data flows for health projects quite often, and one sentence appears in almost every design document: "the data are anonymised". Then I look closer and the data are pseudonymised. The difference is not academic. Under the GDPR it decides whether the law applies at all. The two words Pseudonymised data are personal data where the direct identifiers (name, insurance number) were replaced with something else,…
OAuth in mobile apps: use PKCE, and stop shipping client secrets in the APK
Every few months I review a mobile app that ships an OAuth client secret inside the binary. Extracting a string from an APK or IPA takes about ten minutes, so that secret is public the day the app is published. Here is the setup that actually works for native apps. Mobile apps are public clients A public client is one that cannot keep a secret: native apps, single page apps, desktop apps. The OAuth specs say so…
if your .env.example has a real-looking secret in it…
if your .env.example has a real-looking secret in it, someone will deploy it to production unchanged. use CHANGE_ME and make the app refuse to start when it sees it. ask me how i know
Where should a browser app keep its tokens? Not localStorage (mostly)
This question comes up in every code review I do for a new web app, so I am writing the long answer once. The short version For a first-party web app (your frontend talks to your own API): keep the session in an HttpOnly, Secure, SameSite cookie , and do not put long-lived tokens anywhere JavaScript can read them. If you must use OAuth access tokens in the browser, keep the access token in memory and short-lived,…
Threat modelling a payment flow in 45 minutes with STRIDE and a whiteboard
Threat modelling has a reputation for being a heavy process with special tools and a 40 page document nobody reads. It does not have to be. For most features, a 45 minute session with the people who built it finds the important problems. This is the format I use with product teams at the bank. Before the session (10 minutes, one person) Draw the data flow on one page. Boxes for components, arrows for data, and…