DEV Community

#authentication

User authentication mechanisms

Posts

đź‘‹ Sign in for the ability to sort posts by relevant, latest, or top.
PKCE Downgrade Attack: When the Authorization Server Accepts Both Flows
roxdavirox profile
Davi

PKCE Downgrade Attack: When the Authorization Server Accepts Both Flows

#authentication #cybersecurity #security
Comments
5 min read
LDAP Injection in API Login Endpoints: Filter Corruption, CVEs, and the Active Directory Scope
roxdavirox profile
Davi

LDAP Injection in API Login Endpoints: Filter Corruption, CVEs, and the Active Directory Scope

#api #authentication #cybersecurity #security
Comments
5 min read
JWT Vulnerabilities Are API Design Bugs: Three Implementation Decisions That Betray Cryptographic Intent
roxdavirox profile
Davi

JWT Vulnerabilities Are API Design Bugs: Three Implementation Decisions That Betray Cryptographic Intent

#api #authentication #cybersecurity #security
Comments
5 min read
Type Juggling in API Authentication: How Sending `true` Bypasses a Password Check
roxdavirox profile
Davi

Type Juggling in API Authentication: How Sending `true` Bypasses a Password Check

#authentication #cybersecurity #php #security
Comments
5 min read
Working: Device Flow Phishing -- The OAuth Attack That Uses the Real Login Page
roxdavirox profile
Davi

Working: Device Flow Phishing -- The OAuth Attack That Uses the Real Login Page

#authentication #cybersecurity #infosec #security
Comments
5 min read
SAML XSW: Signatures That Validate the Wrong Element
roxdavirox profile
Davi

SAML XSW: Signatures That Validate the Wrong Element

#authentication #cybersecurity #infosec #security
Comments
5 min read
JWT Key Reference Injection: The Attack Class That Wins Bounties While Guides Miss It
roxdavirox profile
Davi

JWT Key Reference Injection: The Attack Class That Wins Bounties While Guides Miss It

#authentication #cybersecurity #infosec #security
Comments
5 min read
API Session Fixation Is Three Attacks, Not One — and Rotating Tokens Blocks None of Them
roxdavirox profile
Davi

API Session Fixation Is Three Attacks, Not One — and Rotating Tokens Blocks None of Them

#api #authentication #cybersecurity #security
Comments
5 min read
Server-Sent Events Security: How EventSource Breaks Your API Authentication Model
roxdavirox profile
Davi

Server-Sent Events Security: How EventSource Breaks Your API Authentication Model

#api #authentication #backend #security
Comments
4 min read
Rate Limiting Fails in Production Because It Counts the Wrong Dimension
roxdavirox profile
Davi

Rate Limiting Fails in Production Because It Counts the Wrong Dimension

#authentication #cybersecurity #production #security
Comments
6 min read
The OAuth Implicit Flow Is Deprecated, But Your Access Tokens Are Still Leaking
roxdavirox profile
Davi

The OAuth Implicit Flow Is Deprecated, But Your Access Tokens Are Still Leaking

#authentication #cybersecurity #javascript #security
Comments
4 min read
OAuth Access Token Leakage via Logs and APM: The RFC 6750 Warning Nobody Enforced
roxdavirox profile
Davi

OAuth Access Token Leakage via Logs and APM: The RFC 6750 Warning Nobody Enforced

#api #authentication #cybersecurity #security
Comments
5 min read
Three Signal Channels Leak Valid Account Lists Before Authentication Completes: Status Code, Response Body, and Timing
roxdavirox profile
Davi

Three Signal Channels Leak Valid Account Lists Before Authentication Completes: Status Code, Response Body, and Timing

#api #authentication #cybersecurity #security
Comments
5 min read
OAuth 2.0 redirect_uri Bypass: The 5-Condition Matrix That Determines Exploitability
roxdavirox profile
Davi

OAuth 2.0 redirect_uri Bypass: The 5-Condition Matrix That Determines Exploitability

#authentication #cybersecurity #infosec #security
Comments
6 min read
AuthGeek: a desktop TOTP authenticator with an Argon2 vault and no cloud sync
techygeeks1 profile

AuthGeek: a desktop TOTP authenticator with an Argon2 vault and no cloud sync

#authentication #opensource #privacy #security
Comments
2 min read
đź‘‹ Sign in for the ability to sort posts by relevant, latest, or top.