DEV Community

#backend

Desenvolvimento do lado do servidor, APIs, bancos de dados e logica de negocios.

Posts

đź‘‹ Sign in for the ability to sort posts by relevant, latest, or top.
Webhook Signature Bypass: When the Receiver Skips the HMAC Check
rxkov profile
Rxkov

Webhook Signature Bypass: When the Receiver Skips the HMAC Check

#api #backend #cybersecurity #security
Comments
5 min read
Webhook Producers Are SSRF by Default: Seven CVEs the Security Guides Don't Mention
rxkov profile
Rxkov

Webhook Producers Are SSRF by Default: Seven CVEs the Security Guides Don't Mention

#backend #cybersecurity #infosec #security
Comments
5 min read
SSTI in APIs: When JSON Parameters Reach Template Engines and Become RCE
rxkov profile
Rxkov

SSTI in APIs: When JSON Parameters Reach Template Engines and Become RCE

#api #backend #cybersecurity #security
Comments
5 min read
Working: Rate Limiters Key on Raw Paths — Routers Normalize After
rxkov profile
Rxkov

Working: Rate Limiters Key on Raw Paths — Routers Normalize After

#backend #cybersecurity #security
Comments
4 min read
API Versioning: When /api/v1/ Survives Without the Authentication Added in /api/v2/
rxkov profile
Rxkov

API Versioning: When /api/v1/ Survives Without the Authentication Added in /api/v2/

#api #backend #cybersecurity #security
Comments
5 min read
gRPC Server Reflection: The Unauthenticated API Catalog in Your Production Service
rxkov profile
Rxkov

gRPC Server Reflection: The Unauthenticated API Catalog in Your Production Service

#api #backend #cybersecurity #security
Comments
5 min read
CRLF Injection in API Responses: When User Input Reaches HTTP Headers
rxkov profile
Rxkov

CRLF Injection in API Responses: When User Input Reaches HTTP Headers

#api #backend #cybersecurity #security
Comments
5 min read
Framework Binding Gap: How the ORM Accepts Fields You Never Documented
rxkov profile
Rxkov

Framework Binding Gap: How the ORM Accepts Fields You Never Documented

#backend #cybersecurity #database #security
Comments
6 min read
gRPC Security: The Authorization Model REST Scanners Cannot See
rxkov profile
Rxkov

gRPC Security: The Authorization Model REST Scanners Cannot See

#api #backend #cybersecurity #security
Comments
5 min read
Race Conditions in APIs: TOCTOU in Payments, Coupons, and Rate Limiting
rxkov profile
Rxkov

Race Conditions in APIs: TOCTOU in Payments, Coupons, and Rate Limiting

#api #backend #cybersecurity #security
Comments
6 min read
Mass Assignment in REST APIs: When the Framework Binds More Than It Should
rxkov profile
Rxkov

Mass Assignment in REST APIs: When the Framework Binds More Than It Should

#api #backend #security
Comments
5 min read
REST API File Upload Attack Chains: MIME Bypass, Path Traversal, and SVG-to-XSS
rxkov profile
Rxkov

REST API File Upload Attack Chains: MIME Bypass, Path Traversal, and SVG-to-XSS

#api #backend #cybersecurity #security
Comments
6 min read
Non-Constant-Time Comparison Turns Every API Token into a Character-by-Character Oracle
rxkov profile
Rxkov

Non-Constant-Time Comparison Turns Every API Token into a Character-by-Character Oracle

#api #backend #cybersecurity #security
Comments
5 min read
The most dangerous API response is HTTP 200 with an empty body
mohammed_arshadansari_f2 profile

The most dangerous API response is HTTP 200 with an empty body

#api #backend #monitoring
Comments
4 min read
API Token in Query Parameter: Six Places the Credential Persists Without You Knowing
rxkov profile
Rxkov

API Token in Query Parameter: Six Places the Credential Persists Without You Knowing

#api #backend #cybersecurity #security
Comments
5 min read
đź‘‹ Sign in for the ability to sort posts by relevant, latest, or top.