JWT mistakes that keep showing up in code review
The token is signed, not encrypted. Pin the algorithm, check the claims, and think twice about where you store it and how you will ever revoke it.
Category
Cyber Security
Practical security notes for people who build and run web applications and servers.
Password hashing parameters you can defend in an audit
Choosing Argon2id, scrypt, bcrypt or PBKDF2 is the easy part. Setting the cost, upgrading old hashes and avoiding bcrypt truncation is where audits find problems.
You committed a secret. Rotate first, rewrite later
Removing a key from the latest commit does nothing for the copies that already exist. The order of the response matters more than the cleanup tool.
SSRF: checking the URL is not the same as checking the IP
A blocklist of "localhost" and "127.0.0.1" fails against decimal IPs, short forms and DNS names that point inward. Validate what the name resolves to.
Hardening a small VPS: the ten minutes that matter most
A fresh server is scanned within minutes. Key-only SSH, automatic security updates and knowing what is listening cover most of what actually gets exploited.
SQL injection in ORM apps: where it still gets in
The ORM parameterises values. It does not help with raw fragments, dynamic column names, sort orders or LIKE patterns, which is where the bugs are.
Verifying webhook signatures without getting it subtly wrong
Use the raw request body, compare in constant time, check the timestamp and make the handler idempotent. Most broken verifications fail on the first of those.
Dependency pinning with hashes, and dependency confusion
Pinning versions protects you from surprises. Pinning hashes protects you from a different package with the same version. Private package names need care too.
SPF, DKIM and DMARC: what developers get wrong
Two SPF records, ten DNS lookups, a DKIM key nobody rotated and a DMARC policy that is still p=none after two years. All common, all fixable in DNS.
