DEV Community

API

Application Programming Interface

Posts

đź‘‹ Sign in for the ability to sort posts by relevant, latest, or top.
HTTP/2 Rapid Reset: How the Protocol Amplifies DoS Against API Gateways
rxkov profile
Rxkov

HTTP/2 Rapid Reset: How the Protocol Amplifies DoS Against API Gateways

#api #cybersecurity #networking #security
Comments
5 min read
HTTP Verb Tampering in REST APIs: When OPTIONS and HEAD Bypass Access Control
rxkov profile
Rxkov

HTTP Verb Tampering in REST APIs: When OPTIONS and HEAD Bypass Access Control

#api #backend #cybersecurity #security
Comments
5 min read
Webhook Signature Bypass: When the Receiver Skips the HMAC Check
rxkov profile
Rxkov

Webhook Signature Bypass: When the Receiver Skips the HMAC Check

#api #backend #cybersecurity #security
Comments
5 min read
API Key Scope Validation Failures: When 'Read-Only' Is a Documentation Claim, Not a Backend Constraint
rxkov profile
Rxkov

API Key Scope Validation Failures: When 'Read-Only' Is a Documentation Claim, Not a Backend Constraint

#api #backend #cybersecurity #security
Comments
5 min read
Server-Sent Events Security: How EventSource Breaks Your API Authentication Model
rxkov profile
Rxkov

Server-Sent Events Security: How EventSource Breaks Your API Authentication Model

#api #authentication #backend #security
Comments
4 min read
API Gateway Path Normalization Bypass: When HAProxy Sees /admin and Your App Sees /admin
rxkov profile
Rxkov

API Gateway Path Normalization Bypass: When HAProxy Sees /admin and Your App Sees /admin

#api #architecture #cybersecurity #security
Comments
5 min read
Working: CORS misconfigurations escape automated detection
rxkov profile
Rxkov

Working: CORS misconfigurations escape automated detection

#api #cybersecurity #infosec #security
Comments
5 min read
API Log Redaction: Filtering After Serialization Does Not Work
rxkov profile
Rxkov

API Log Redaction: Filtering After Serialization Does Not Work

#api #architecture #cybersecurity #security
Comments
5 min read
CORS Misconfiguration in APIs: Why Reflected Origin Plus Credentials Is the Dangerous Pattern, Not Wildcard
rxkov profile
Rxkov

CORS Misconfiguration in APIs: Why Reflected Origin Plus Credentials Is the Dangerous Pattern, Not Wildcard

#api #cybersecurity #infosec #security
Comments
6 min read
API SSRF: Allowlists Fail Because They Validate the URL, Not the Resolved IP
rxkov profile
Rxkov

API SSRF: Allowlists Fail Because They Validate the URL, Not the Resolved IP

#api #cybersecurity #infosec #security
Comments
6 min read
SSTI in APIs: When JSON Parameters Reach Template Engines and Become RCE
rxkov profile
Rxkov

SSTI in APIs: When JSON Parameters Reach Template Engines and Become RCE

#api #backend #cybersecurity #security
Comments
5 min read
HMAC Proves Origin, Not Freshness: Replay Attacks Against Signed APIs
rxkov profile
Rxkov

HMAC Proves Origin, Not Freshness: Replay Attacks Against Signed APIs

#api #authentication #cybersecurity #security
Comments
6 min read
OAuth Access Token Leakage via Logs and APM: The RFC 6750 Warning Nobody Enforced
rxkov profile
Rxkov

OAuth Access Token Leakage via Logs and APM: The RFC 6750 Warning Nobody Enforced

#api #authentication #cybersecurity #security
Comments
5 min read
NoSQL Injection in APIs: From Auth Bypass to JavaScript Execution via MongoDB Operators
rxkov profile
Rxkov

NoSQL Injection in APIs: From Auth Bypass to JavaScript Execution via MongoDB Operators

#api #cybersecurity #database #security
Comments
5 min read
API Session Fixation Is Three Attacks, Not One — and Rotating Tokens Blocks None of Them
rxkov profile
Rxkov

API Session Fixation Is Three Attacks, Not One — and Rotating Tokens Blocks None of Them

#api #authentication #cybersecurity #security
Comments
5 min read
đź‘‹ Sign in for the ability to sort posts by relevant, latest, or top.