DEV Community

API

Application Programming Interface

Posts

đź‘‹ Sign in for the ability to sort posts by relevant, latest, or top.
API Session Fixation Is Three Attacks, Not One — and Rotating Tokens Blocks None of Them
rxkov profile
Rxkov

API Session Fixation Is Three Attacks, Not One — and Rotating Tokens Blocks None of Them

#api #authentication #cybersecurity #security
Comments
5 min read
NoSQL Injection in APIs: From Auth Bypass to JavaScript Execution via MongoDB Operators
rxkov profile
Rxkov

NoSQL Injection in APIs: From Auth Bypass to JavaScript Execution via MongoDB Operators

#api #cybersecurity #database #security
Comments
5 min read
Non-Constant-Time Comparison Turns Every API Token into a Character-by-Character Oracle
rxkov profile
Rxkov

Non-Constant-Time Comparison Turns Every API Token into a Character-by-Character Oracle

#api #backend #cybersecurity #security
Comments
5 min read
Prompt Caching Is a Timing Oracle: How the 41-80% Cost Win Becomes Cross-Tenant System Prompt Extraction
rxkov profile
Rxkov

Prompt Caching Is a Timing Oracle: How the 41-80% Cost Win Becomes Cross-Tenant System Prompt Extraction

#api #cybersecurity #llm #security
Comments
4 min read
Stop Faking Your Test Data: Why `Faker.js` Breaks the Moment You Have Foreign Keys
jitendra_devabhaktuni_0f1 profile

Stop Faking Your Test Data: Why `Faker.js` Breaks the Moment You Have Foreign Keys

#api #ai #datascience #dataengineering
Comments
5 min read
One API Key Across OpenAI, Claude and Gemini: Chatbot Fallback Options for SaaS Apps
colemitchell4991 profile

One API Key Across OpenAI, Claude and Gemini: Chatbot Fallback Options for SaaS Apps

#chatbot #llm #api #saas
Comments
7 min read
The most dangerous API response is HTTP 200 with an empty body
mohammed_arshadansari_f2 profile

The most dangerous API response is HTTP 200 with an empty body

#api #backend #monitoring
Comments
4 min read
3 API changes to audit before your next deploy: Supabase, HubSpot, and Shopify
breakwaterdev profile

3 API changes to audit before your next deploy: Supabase, HubSpot, and Shopify

#api #devops #webdev #testing
Comments
3 min read
GraphQL APQ Registration Bypasses Query Allowlists and Introspection Controls
rxkov profile
Rxkov

GraphQL APQ Registration Bypasses Query Allowlists and Introspection Controls

#api #cybersecurity #infosec #security
Comments
5 min read
Three Signal Channels Leak Valid Account Lists Before Authentication Completes: Status Code, Response Body, and Timing
rxkov profile
Rxkov

Three Signal Channels Leak Valid Account Lists Before Authentication Completes: Status Code, Response Body, and Timing

#api #authentication #cybersecurity #security
Comments
5 min read
SSRF in APIs: Six URL-Accepting Parameter Types and the IMDSv1/IMDSv2 Decision That Determines Severity
rxkov profile
Rxkov

SSRF in APIs: Six URL-Accepting Parameter Types and the IMDSv1/IMDSv2 Decision That Determines Severity

#api #aws #cybersecurity #security
Comments
5 min read
A field disappeared from Shopify webhooks for two days and every monitor stayed green
balboubal profile

A field disappeared from Shopify webhooks for two days and every monitor stayed green

#webhooks #shopify #api #testing
Comments
9 min read
GraphQL in Production: Introspection, Alias Batching, and Rate Limit Bypass on Real APIs
rxkov profile
Rxkov

GraphQL in Production: Introspection, Alias Batching, and Rate Limit Bypass on Real APIs

#api #cybersecurity #infosec #security
Comments
6 min read
API Token in Query Parameter: Six Places the Credential Persists Without You Knowing
rxkov profile
Rxkov

API Token in Query Parameter: Six Places the Credential Persists Without You Knowing

#api #backend #cybersecurity #security
Comments
5 min read
JWT kid Parameter Attacks: SQL Injection and Path Traversal via Key ID
rxkov profile
Rxkov

JWT kid Parameter Attacks: SQL Injection and Path Traversal via Key ID

#api #backend #cybersecurity #security
Comments
5 min read
đź‘‹ Sign in for the ability to sort posts by relevant, latest, or top.