Security/OWASP: Guides and Practical Know-how | Page 14 | mironsoft Blog
Security/OWASP
-
Jul 28, 2025
A container is not a virtual machine, it is an isolated process sharing the same kernel with the host. Container escape prevention means consistently hardening exactly that boundary: no unnecessary privileges, no mounted sockets, active seccomp and AppArmor profiles, and a current kernel, so a compromised container never becomes a stepping stone to the host.
-
Jul 26, 2025
The File System Access API gives web applications real read and write access to local files and folders, without the classic detour through uploads and downloads. Anyone building editors, image tools or data exports in the browser gets behavior that feels almost like a native desktop application, including a permission model and persistent handles.
-
Jul 24, 2025
Passwords share one structural flaw: the server and the user hold the same secret, and every place that secret ever gets typed or stored becomes a potential attack surface. WebAuthn solves this at the root by replacing shared secrets entirely with asymmetric public-key cryptography. Understanding why passkeys are not just more convenient but structurally more secure than passwords requires walking through the registration and authentication ceremony in detail.
-
Jul 23, 2025
A single call to htmlspecialchars() is often mistaken for complete XSS protection, yet safe output encoding always depends on where the value ends up: HTML body, HTML attribute, JavaScript string and URL each require their own escaping rules, and mixing them up leaves open exactly the gap that was supposed to be closed.
-
Jul 21, 2025
Environment variables separate configuration from code, but the same mechanism that makes secrets flexible also makes them exposed. Reachable phpinfo() calls, credentials baked into Docker images, and unprotected env.php files rank among the most common causes of data leaks in PHP and Magento projects. This article shows concrete countermeasures for Docker, CI/CD, and Magento.
-
Jul 21, 2025
Single sign-on through an external identity provider takes more than redirecting a login button. This guide shows how OAuth2 and OpenID Connect are integrated cleanly into Symfony, from the authorization code flow through ID token validation to role mapping into your own user management.
-
Jul 21, 2025
Unpatched servers are the most common entry point for attackers, but fully automatic updates without oversight carry their own risk. This article shows how unattended-upgrades reliably applies security patches, reports failures by email, and moves reboots into a plannable maintenance window instead of interrupting operations unpredictably.
-
Jul 18, 2025
Discovering a breach weeks after it happened means the decisive advantage is already gone. This article explains which security-relevant events actually need to be logged, how sensitive data like passwords and tokens stays protected while doing so, how central log aggregation makes anomalies visible, and how alert thresholds are set without exhausting the team with constant false positives.
-
Jul 16, 2025
An open security group that accidentally allows access from the entire internet, or a storage bucket without encryption, rarely comes from malicious intent. It usually comes from an overlooked default value in a Terraform file. Infrastructure-as-Code security scanning checks exactly these configurations automatically, before they are ever applied, preventing misconfigurations from surfacing only through a manual audit or, worse, through an actual incident.
-
Jul 15, 2025
PhpStorm's built-in HTTP client is, for many PHP and Magento developers, the fastest way to test REST and GraphQL endpoints straight from the IDE. Anyone who writes admin tokens, API keys, or database credentials in plain text into a .http file risks, sooner or later, having those exact values end up in the next commit. This article shows how http-client.env.json and http-client.private.env.json separate public and private environment variables cleanly, so the whole team can share the same requests without everyone seeing the same secrets.