Web security · 4 min read
Broken access control: the bug class that outlives every framework
Frameworks solved authentication a decade ago. Authorisation is still hand-written per endpoint, which is why the same finding leads report after report.
Web security
Web Application Security Articles
What this covers
These posts cover web application security as it turns up in manual testing: broken access control, session and password-reset handling, injection in its less obvious forms, and business-logic abuse that no automated scan will ever report.
Most web breaches are not exotic. They are an object ID that can be incremented, a reset token that never expires, or an admin route protected only by the interface not rendering a link. These posts are about that class of bug and the structural fixes for it.
2 posts in Web security.
Web security · 3 min read
The password reset flow is your real authentication system
Nobody attacks your login form. They attack the flow that issues credentials to whoever holds an email address — which is usually written once and never reviewed.
Want this tested properly?
Scope and a fixed quote within two working days. First consultation is free.