Security field notes

Understand the bug. See the exploit. Ship the fix.

Practical guides to real-world web vulnerabilities, written by the team building the scanner that finds them.

Find a vulnerability guide

65 deep-dives · 27 topics

Follow via RSS

Posts tagged #access-control

3 posts

All topics Clear tag filter

Access & configurationOverview X-Original-URL: /admin

Access Control8 min read

Access Control Bypass, Explained: Why a 403 at the Proxy Is Not Authorization

A 403 Forbidden only proves that one spelling of a request was refused. Here is how trailing slashes, path parameters, rewrite headers like X-Original-URL, spoofed client IPs and alternate methods walk past gates enforced at a proxy or router, and why the decision has to live in the application.

Client-side & redirectsOverview <form method="post" action="https://app.example/account/email">

Cross-Site Request Forgery7 min read

Cross-Site Request Forgery, Explained: From a Hidden Form to an Account Takeover

A signed-in browser attaches its session cookie to requests that another site starts. Here is how cross-site request forgery turns that into actions the user never chose, why SameSite cookies alone do not settle it, and how tokens and origin checks close the gap.

Client-side & redirects new WebSocket('wss://app.example/ws')

Cross-Site Request Forgery6 min read

Cross-Site WebSocket Hijacking: CSRF on a Connection That Talks Back

A WebSocket handshake carries the user's cookies but faces no CORS check. When the server skips Origin validation, any page the user visits can open an authenticated socket, read what it pushes and send commands back. Here is how to test for it and how to close it.