Security field notes

Understand the bug. See the exploit. Ship the fix.

Practical guides to real-world web vulnerabilities, written by the team building the scanner that finds them.

Find a vulnerability guide

65 deep-dives · 27 topics

Follow via RSS

Posts tagged #authentication

2 posts

All topics Clear tag filter

Access & configurationOverview {"alg":"none","typ":"JWT"}

JWT8 min read

JWT Attacks, Explained: When a Token Decides How to Verify Itself

A JSON Web Token is only as trustworthy as the check that verifies it. Here is how alg:none, algorithm confusion, weak secrets and injected key headers turn a signed token into one anyone can mint, and how to pin verification down.

Access & configuration <input type="password" name="password">

Security Headers7 min read

Password Autocomplete: What the Browser Remembers and How to Mark Password Fields

Browsers offer to save and refill passwords unless the page says what each field is for. Here is what the autocomplete attribute can and cannot control, where a saved password does real harm, and how to mark sign-in, sign-up, reset and one-time fields.