Security/OWASP: Guides and Practical Know-how | mironsoft Blog
Security/OWASP
-
May 9, 2026
A compromised admin password is one of the most common entry points for attackers against Magento stores, because a single factor is enough to take over payment configuration, customer data and the entire store setup. This article shows how to configure the Magento_TwoFactorAuth module, which providers are available, how to enforce Two-Factor Authentication store-wide through configuration or per role, how the underlying CLI commands work, how to implement a custom TFA provider using the ProviderInterface, how to register it through di.xml, and which pitfalls typically appear when operating 2FA behind a reverse proxy, in a headless setup or on a staging environment.
-
May 6, 2026
The Reporting API gives browsers a standardized way to automatically report problems like CSP violations, deprecated API usage, or even tab crashes to a central endpoint. Unlike classic error tracking, this happens largely without additional JavaScript and captures cases custom code would never see.
-
May 4, 2026
Servers that run SSH with password login and an open root account are a preferred target for automated brute force attacks from across the internet. This article shows in practice how key based authentication, a consistently hardened sshd_config, clean client configuration through host specific entries, and fail2ban as a complementary layer secure SSH access on production Linux servers reliably and permanently, without exotic extra tools.
-
May 3, 2026
SUID, SGID, and the sticky bit control which rights a program runs with, who inherits group ownership, and who is allowed to delete files in shared directories. Used correctly, they enable safe system tools like passwd and stable shared project folders without constant manual permission fixes. Misconfigured, unnoticed SUID binaries open a classic path to privilege escalation that every administrator should audit regularly.
-
Apr 30, 2026
Prototype pollution is a JavaScript-specific vulnerability class in which an attacker, via an unsafe object merge, writes properties onto `Object.prototype` itself instead of onto the actually intended target object, causing these manipulated properties to subsequently appear on every newly created object across the entire application, often with serious consequences up to remote code execution. This vulnerability affects both client-side browser code and server-side Node.js code and is especially tricky because the triggering merge code looks completely harmless at first glance.
-
Apr 26, 2026
Server logs almost always contain personal data such as IP addresses, which makes any GDPR log retention a concrete legal question. Anyone who knows the retention periods, configures logrotate correctly and implements pseudonymization technically operates logging that remains both forensically useful and privacy compliant.
-
Apr 26, 2026
GraphQL endpoints in Magento stores open new attack paths: enabled introspection exposes the full schema, deeply nested queries overload the database and server, and alias-based batching enables brute-force attacks against login forms. This article shows how to disable introspection in production, limit query depth and complexity, control batching, and correctly implement field-level authorization so your Magento GraphQL endpoint stays resilient against targeted attacks.
-
Apr 25, 2026
Webhooks from Stripe, GitHub, Shopify or your own services arrive as HTTP POST requests, without type safety, without schema guarantees, and potentially from spoofed senders. Symfony offers a complete infrastructure with the Webhook component, Messenger and HMAC signature verification to process external events safely, type-safely and asynchronously.
-
Apr 18, 2026
Every Docker image starts with a base image that the whole team trusts blindly, usually referenced by a tag like latest or a version number without further checks. Supply chain security replaces that blind trust with pinned digests, cryptographic signatures, and traceable provenance information, so a compromised base image does not silently reach production deployments.
-
Apr 14, 2026
Few browser features are misused as often as the Notifications API: a permission dialog fired on the very first page visit leads to permanent rejection in the vast majority of cases. Implemented correctly, with proper timing, clear context and service worker integration, the same API becomes a feature users actively request instead of dismissing on sight.