Securing Modern APIs: Why BOLA and Mass Assignment Slip Past the OWASP Top 10
If you only take one thing from this post, take this: scope every object lookup to the authenticated owner, and never l…
#API Security
4 posts
Defending the Front Door: Implementing CrowdSec & Rate-Limiting to Stop Credential Stuffing
You enabled MFA. Your login page checks TOTP codes. Attackers can't get in. So why is your server still drowning? Becau…
Beyond the Login Screen: Securing Session Tokens, JWTs, and Cookies After Authentication
The short version: store access tokens in JavaScript memory, put refresh tokens in HttpOnly/Secure/SameSite cookies, ro…
OWASP API Security Top 10: A Practical Guide for IT Professionals
Introduction In today's interconnected digital landscape, Application Programming Interfaces (APIs) have become the bac…