Security/OWASP: Guides and Practical Know-how | Page 13 | mironsoft Blog
Security/OWASP
-
Aug 17, 2025
Teams that build Magento applications without systematic security testing rely on luck instead of tools that reliably surface vulnerabilities. Static analysis with PHPStan and Psalm catches dangerous data flows directly in the source code, while dynamic scanners like OWASP ZAP run real attacks against a running staging environment. This article shows how both approaches work together, where their limits lie, and when each investment pays off.
-
Aug 11, 2025
Embedded third party content such as payment widgets, ad banners or comment systems runs in the same document as your own application and, without consistent isolation, poses a substantial security risk. The sandbox attribute on iframe elements and strict origin checking in postMessage communication enable genuine isolation without blocking the actual functionality of embedded widgets.
-
Aug 10, 2025
A REST API without correctly documented security requirements is a black box for consumers. OpenAPI 3.x offers four security scheme types that can be made directly usable in the Swagger UI, if you know how to model them correctly, combine them globally and endpoint-specifically, and control them granularly with scopes.
-
Aug 7, 2025
The moment a Claude application processes foreign content, whether user documents, web pages or emails, a new attack surface opens up: embedded instructions that try to override the actual system behavior. Prompt injection is therefore not a theoretical edge case but a concrete security risk for every production AI integration.
-
Aug 3, 2025
The login process is the entry point to virtually every personalized feature of a Magento application, from order history through saved addresses to the wish list, and at the same time one of the most frequently, silently broken areas of a test suite, since login tests are especially prone to orphaned test users, expired test sessions, and accidentally checked-in credentials. A cleanly built authentication test flow treats login, logout, session timeout, and two-factor authentication as separate, clearly distinguished test cases backed by thoughtful test user management, instead of blending every aspect into a single, cluttered test case.
-
Aug 3, 2025
The classic network perimeter model rests on a simple but increasingly shaky assumption: whatever sits inside the firewall is trusted, whatever sits outside has to prove itself. Once an attacker breaches that outer perimeter, whether through a compromised home-office laptop or a stolen VPN certificate, they often move almost freely across the internal network. Zero-trust architecture throws out that assumption entirely in favor of never trust, always verify, where every single request gets re-evaluated regardless of where it originates.
-
Jul 31, 2025
Running every container in the default bridge network means giving up name resolution, isolation between projects and the ability to cut containers off from the internet on purpose. A dedicated bridge network per project solves exactly these three problems with a few lines of configuration.
-
Jul 30, 2025
A Content Security Policy with the unsafe-inline directive lets every inline script on the page run, whether it came from your own team or was injected by an attacker through cross-site scripting. That is not a minor caveat, it nearly guts the whole protective purpose of a CSP. CSP Level 3 solves this dilemma with a nonce value freshly generated on every request, unlocking legitimate inline scripts on a granular basis while every injected, unauthorized script stays blocked.
-
Jul 30, 2025
Compliance automation with OpenSCAP turns manual, error prone checklists into repeatable scans against recognized SCAP profiles. Using the SCAP Security Guide correctly, generating automatic remediation scripts and running the process continuously via Ansible and oscapd turns compliance into an observable operational state instead of a one time preparation for an audit.
-
Jul 29, 2025
The N+1 problem is the most common performance antipattern in GraphQL APIs. It arises when every resolver of a list element triggers its own database query. The result: 100 products mean 101 queries. Batching and the DataLoader pattern solve the problem systematically, without sacrificing the flexibility of GraphQL.