DEV Community

API

Application Programming Interface

Posts

đź‘‹ Sign in for the ability to sort posts by relevant, latest, or top.
HTTP/2 Rapid Reset: How the Protocol Amplifies DoS Against API Gateways
rxkov profile
Rxkov

HTTP/2 Rapid Reset: How the Protocol Amplifies DoS Against API Gateways

#api #cybersecurity #networking #security
Comments
5 min read
Web Cache Deception Against APIs: CDNs Cache What Backends Serve Privately
rxkov profile
Rxkov

Web Cache Deception Against APIs: CDNs Cache What Backends Serve Privately

#api #backend #cybersecurity #security
Comments
6 min read
API Log Redaction: Filtering After Serialization Does Not Work
rxkov profile
Rxkov

API Log Redaction: Filtering After Serialization Does Not Work

#api #architecture #cybersecurity #security
Comments
5 min read
API SSRF: Allowlists Fail Because They Validate the URL, Not the Resolved IP
rxkov profile
Rxkov

API SSRF: Allowlists Fail Because They Validate the URL, Not the Resolved IP

#api #cybersecurity #infosec #security
Comments
6 min read
SSTI in APIs: When JSON Parameters Reach Template Engines and Become RCE
rxkov profile
Rxkov

SSTI in APIs: When JSON Parameters Reach Template Engines and Become RCE

#api #backend #cybersecurity #security
Comments
5 min read
Working: CORS misconfigurations escape automated detection
rxkov profile
Rxkov

Working: CORS misconfigurations escape automated detection

#api #cybersecurity #infosec #security
Comments
5 min read
CORS Misconfiguration in APIs: Why Reflected Origin Plus Credentials Is the Dangerous Pattern, Not Wildcard
rxkov profile
Rxkov

CORS Misconfiguration in APIs: Why Reflected Origin Plus Credentials Is the Dangerous Pattern, Not Wildcard

#api #cybersecurity #infosec #security
Comments
6 min read
OAuth Access Token Leakage via Logs and APM: The RFC 6750 Warning Nobody Enforced
rxkov profile
Rxkov

OAuth Access Token Leakage via Logs and APM: The RFC 6750 Warning Nobody Enforced

#api #authentication #cybersecurity #security
Comments
5 min read
HMAC Proves Origin, Not Freshness: Replay Attacks Against Signed APIs
rxkov profile
Rxkov

HMAC Proves Origin, Not Freshness: Replay Attacks Against Signed APIs

#api #authentication #cybersecurity #security
Comments
6 min read
JWT Vulnerabilities Are API Design Bugs: Three Implementation Decisions That Betray Cryptographic Intent
rxkov profile
Rxkov

JWT Vulnerabilities Are API Design Bugs: Three Implementation Decisions That Betray Cryptographic Intent

#api #authentication #cybersecurity #security
Comments
5 min read
BFLA Survives Pentests: Why Testers Never Try the Wrong HTTP Method
rxkov profile
Rxkov

BFLA Survives Pentests: Why Testers Never Try the Wrong HTTP Method

#api #cybersecurity #security #testing
Comments
5 min read
gRPC Security: The Authorization Model REST Scanners Cannot See
rxkov profile
Rxkov

gRPC Security: The Authorization Model REST Scanners Cannot See

#api #backend #cybersecurity #security
Comments
5 min read
S3 Pre-Signed URLs Are Bearer Tokens: Five Attack Surfaces API Developers Miss
rxkov profile
Rxkov

S3 Pre-Signed URLs Are Bearer Tokens: Five Attack Surfaces API Developers Miss

#api #aws #cybersecurity #security
Comments
5 min read
Content-Type Confusion in REST APIs: One Header Switch, Three Attack Surfaces
rxkov profile
Rxkov

Content-Type Confusion in REST APIs: One Header Switch, Three Attack Surfaces

#api #cybersecurity #java #security
Comments
5 min read
API Session Fixation Is Three Attacks, Not One — and Rotating Tokens Blocks None of Them
rxkov profile
Rxkov

API Session Fixation Is Three Attacks, Not One — and Rotating Tokens Blocks None of Them

#api #authentication #cybersecurity #security
Comments
5 min read
đź‘‹ Sign in for the ability to sort posts by relevant, latest, or top.