CORS: Cross-Origin Resource Sharing
There is a security boundary in every browser that developers eventually run into.
Read article: CORS: Cross-Origin Resource SharingWeb Application Security
10 articles tagged Web Application Security.
OAuth2 Device Authorization Grant: OAuth2 for Devices That Can’t Really Do OAuth2
OAuth2 was designed around the assumption that the client can open a browser.
Read article: OAuth2 Device Authorization Grant: OAuth2 for Devices That Can’t Really Do OAuth2
The Software Architect Who Believed in Bug-Free Software
I once worked with an architect who had a fascinating theory about software development.
Read article: The Software Architect Who Believed in Bug-Free Software
Content Security Policy: Putting the Browser on a Security Diet
Web applications have become remarkably powerful.
Read article: Content Security Policy: Putting the Browser on a Security Diet
Input Validation: Because Users Are Creative, and Attackers Are More Creative
There is a special kind of optimism that exists in software development.
Read article: Input Validation: Because Users Are Creative, and Attackers Are More Creative
Prevent XSS and Other Common Attacks on Your App
Regardless of your application architecture or front-end type, there are a variety of common attack types that the application security architecture’s capabilities must protect against. I’ve talked about these topics briefly before here, here, and here.
Read article: Prevent XSS and Other Common Attacks on Your App
Static Credentials Must Not Be Used In The Browser
Authentication is described in this post.
Read article: Static Credentials Must Not Be Used In The Browser
More Single Page Application (SPA) and OAuth2 Thoughts
This post continues where “SECURELY USING THE OIDC AUTHORIZATION CODE FLOW AND A PUBLIC CLIENT WITH SINGLE PAGE APPLICATIONS” left off on the topic of securing Single Page Applications (SPAs). That post describes an architecture where the SPA running in the browser (User Agent)is acting as the…
Read article: More Single Page Application (SPA) and OAuth2 Thoughts
URL & HTML Character Representation
I’ve had to look up the HTML codes for special characters like space many times. In fact, while writing blog entries for Thinkmiddleware.com, I’ve had to stop and look up the HTML code for less-than sign and greater-than sign one to many times. I just haven’t bothered memorizing them.
Read article: URL & HTML Character Representation
Google Browser Security Handbook
Google has released a Browser Security Handbook online. It can be found here.
Read article: Google Browser Security Handbook