Quick Bites Episode 2 – HTTP Security Headers and Why You NEED Them
Secure Ideas’ Quick Bites Ep 2 – HTTP security headers are important for webapp security. Here are some that will help lockdown your site a little better.
Waving the White Flag: Why InfoSec should stop caring about HTTPOnly
As a company that is constantly working with our penetration testing clients on understanding where they should focus their efforts…
How I Became a Security Consultant: AbsoluteAppsec Interview
Every so often, podcasts and such will invite me to speak on a variety of topics. And this week, I was very excited to join @cktricky and @sethlaw…
Once upon a time there was a WebSocket
This is the story from one of our recent penetration testing engagements.
It’s Okay, We’re All On the SameSite
With Google’s recent announcement that all cookies without a SameSite flag will be treated as having SameSite=Lax set by default in Chrome version 80…
Security Misconfigurations
The configuration of web and application servers is a very important aspect of web applications. Often times, failure to manage proper configurations…
Three C-Words of Web App Security: Part 3 – Clickjacking
Prologue back in April, called A Brief Evolution of Web Apps, to set the scene for those less versed in web application history.
Stored XSS: What Is It
In the cyber security world, there are a number of vulnerabilities to be aware of. Today we’re going to look at a specific one; Stored Cross-Site Scripting
Twelve Days of XSSmas
This series of daily mini-posts, running from December 12, 2018 to December 24, 2018, is intended to provide cross-site scripting (XSS) related tips.
Three C-Words of Web App Security: Part 2 – CSRF
I identified several types of requests as generally considered safer, and therefore not subject to CORS when being sent across origins.