Web & API security
JWT Security: Seven Mistakes That Break Token Authentication
Seven JSON Web Token mistakes that let attackers forge or reuse tokens, from alg none and key confusion to weak secrets, and the RFC 8725 fixes.
· 5 min read
// Blog topic
Web & API security
Vulnerabilities that turn up in real web applications and APIs, how attackers exploit them, and how to fix them.
-
-
Web & API security
Broken Access Control: Why IDOR and BOLA Top Every List
Why broken access control is the number one web risk in OWASP data, how IDOR and BOLA flaws lead to real breaches, why scanners miss them, and how to fix them.
· 6 min read
// Put it into practice
Related services
API Pentest
Testing of REST and GraphQL APIs for broken object-level authorization, auth flaws, mass assignment and data over-exposure.
Web App Pentest
An authenticated test of your web application against the OWASP Top 10 and the business-logic flaws scanners never find.