DEV Community

API

Application Programming Interface

Posts

đź‘‹ Sign in for the ability to sort posts by relevant, latest, or top.
API Key Scope Validation Failures: When 'Read-Only' Is a Documentation Claim, Not a Backend Constraint
rxkov profile
Rxkov

API Key Scope Validation Failures: When 'Read-Only' Is a Documentation Claim, Not a Backend Constraint

#api #backend #cybersecurity #security
Comments
5 min read
API Gateway Path Normalization Bypass: When HAProxy Sees /admin and Your App Sees /admin
rxkov profile
Rxkov

API Gateway Path Normalization Bypass: When HAProxy Sees /admin and Your App Sees /admin

#api #architecture #cybersecurity #security
Comments
5 min read
Server-Sent Events Security: How EventSource Breaks Your API Authentication Model
rxkov profile
Rxkov

Server-Sent Events Security: How EventSource Breaks Your API Authentication Model

#api #authentication #backend #security
Comments
4 min read
Web Cache Deception Against APIs: CDNs Cache What Backends Serve Privately
rxkov profile
Rxkov

Web Cache Deception Against APIs: CDNs Cache What Backends Serve Privately

#api #backend #cybersecurity #security
Comments
6 min read
HTTP/2 Rapid Reset: How the Protocol Amplifies DoS Against API Gateways
rxkov profile
Rxkov

HTTP/2 Rapid Reset: How the Protocol Amplifies DoS Against API Gateways

#api #cybersecurity #networking #security
Comments
5 min read
HTTP Verb Tampering in REST APIs: When OPTIONS and HEAD Bypass Access Control
rxkov profile
Rxkov

HTTP Verb Tampering in REST APIs: When OPTIONS and HEAD Bypass Access Control

#api #backend #cybersecurity #security
Comments
5 min read
Postman's Secret Variables Are Not Secret: How Public Workspaces Expose 4,000+ Live Credentials
rxkov profile
Rxkov

Postman's Secret Variables Are Not Secret: How Public Workspaces Expose 4,000+ Live Credentials

#api #cybersecurity #infosec #security
Comments
6 min read
Working: CORS misconfigurations escape automated detection
rxkov profile
Rxkov

Working: CORS misconfigurations escape automated detection

#api #cybersecurity #infosec #security
Comments
5 min read
SSTI in APIs: When JSON Parameters Reach Template Engines and Become RCE
rxkov profile
Rxkov

SSTI in APIs: When JSON Parameters Reach Template Engines and Become RCE

#api #backend #cybersecurity #security
Comments
5 min read
API SSRF: Allowlists Fail Because They Validate the URL, Not the Resolved IP
rxkov profile
Rxkov

API SSRF: Allowlists Fail Because They Validate the URL, Not the Resolved IP

#api #cybersecurity #infosec #security
Comments
6 min read
CORS Misconfiguration in APIs: Why Reflected Origin Plus Credentials Is the Dangerous Pattern, Not Wildcard
rxkov profile
Rxkov

CORS Misconfiguration in APIs: Why Reflected Origin Plus Credentials Is the Dangerous Pattern, Not Wildcard

#api #cybersecurity #infosec #security
Comments
6 min read
API Log Redaction: Filtering After Serialization Does Not Work
rxkov profile
Rxkov

API Log Redaction: Filtering After Serialization Does Not Work

#api #architecture #cybersecurity #security
Comments
5 min read
OAuth Access Token Leakage via Logs and APM: The RFC 6750 Warning Nobody Enforced
rxkov profile
Rxkov

OAuth Access Token Leakage via Logs and APM: The RFC 6750 Warning Nobody Enforced

#api #authentication #cybersecurity #security
Comments
5 min read
HMAC Proves Origin, Not Freshness: Replay Attacks Against Signed APIs
rxkov profile
Rxkov

HMAC Proves Origin, Not Freshness: Replay Attacks Against Signed APIs

#api #authentication #cybersecurity #security
Comments
6 min read
API Tokens in CI/CD Pipelines: Five Exposure Surfaces That Rotation Does Not Close
rxkov profile
Rxkov

API Tokens in CI/CD Pipelines: Five Exposure Surfaces That Rotation Does Not Close

#api #cicd #devops #security
Comments
5 min read
đź‘‹ Sign in for the ability to sort posts by relevant, latest, or top.