Hueniverse.com

Robin Sillem, William Ferguson This blog post explores performing cross site scripting attacks on your own machine, on some pre-made sample web apps. The focus of this post is on securing web apps, rather than the attacks themselves. It is part of an...

I extract items for the Wrap from my link blog, which you’re welcome to follow. To make sure you never miss an issue, subscribe to my weekly email briefing. Webinar Alert On Thursday I’ll present a webinar on communication to employees about the political...

Lately I’ve been on the road, giving talks about web application security. JSON Web Tokens (JWTs) are the new hotness, and I’ve been trying to demystify them and explain how they can be used securely. In the latest iteration of this talk, I give some...

TL;DR Many modern web applications use JSON Web Tokens (JWT), rather than the traditional session-based authentication. Quite a few challenges have been found with using server-side sessions in modern-day applications. In this post, we’ll identify those...

NB: This is the sixth post in a series of posts on web application security. Don’t put session IDs in the URL. Django explicitly does not support this because it’s just dangerous. Use SSL and secure cookies. Use HttpOnly cookies. Is it really that...