Page 10 - Security/OWASP

DOM based cross site scripting rarely comes from missing server side filtering, it usually comes from unsafe assignments to innerHTML, document.write or eval right in the middle of frontend code. The Trusted Types API closes this gap structurally, letting the browser accept dangerous assignments to DOM sinks only after the value has passed through a defined policy that converts it into a special type.

A single voter with twenty if branches is not an authorization system, it is a maintenance burden. This guide shows how multiple security voters in Symfony are composed cleanly, made reusable through abstract base voters, and combined with the right AccessDecisionManager strategy.

Hashing passwords with MD5 or SHA-1 leaves the door wide open for brute-force and rainbow-table attacks the moment a database leaks. This article explains how bcrypt and Argon2id actually work, how to use PHP's password_hash() correctly in production code, and which mistakes around salts, cost factors, and rehashing happen most often in real-world applications.

Shell scripts rarely survive code reviews without objections, because standardized checklists are simply missing. This Bash checklist covers all critical dimensions: security, error handling, logging, testability with BATS, and static analysis with ShellCheck, systematically and with a practical focus.

A single GraphQL request can combine nested fields, multiple aliases and deep relations, generating as much database load as a thousand simple REST requests. Anyone who implements rate-limiting purely by counting requests per minute does not protect their API against exactly this kind of attack. Query complexity analysis scores every request by its actual cost before it is even executed.

A valid TLS certificate alone does not protect a Magento store from clickjacking, MIME sniffing, or silent data leaks through the referrer header. This article shows in practice how HSTS, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and CSP frame-ancestors work together, how to configure these headers correctly at the webserver or CDN layer instead of in application code, and how scanners like securityheaders.com grade the result.

Anyone who needs to authenticate login forms, API keys or signed headers that no standard bundle covers cannot avoid writing a custom authenticator. With AuthenticatorInterface, Passport and Badges, any authentication logic can be implemented cleanly and testably, without detouring through the outdated Guard classes.

JWT or sessions for Symfony REST APIs? The answer depends on scaling requirements, revocation needs, client type, and security model. Anyone who understands the difference between stateless and stateful authentication can make the right decision for their specific use case.

fail2ban watches log files from SSH and web applications in real time, detects repeated failed logins using configurable patterns, and automatically bans the offending IP address at the firewall. This article shows how administrators can correctly configure jails for SSH and web logins, tune ban times sensibly, and monitor fail2ban activity on an ongoing basis without accidentally locking out legitimate users.

OAuth 2.0 handles authorization, OpenID Connect adds the missing identity layer, and confusing the two leads to insecure logins. This article explains the authorization code flow with PKCE as the current standard, covers common implementation mistakes around redirect URIs, state, and nonce, and shows how to integrate a social login securely into a Magento store.