Page 11 - Security/OWASP

An open redirect vulnerability arises when an application redirects a user to an arbitrary external URL based on a parameter value from the request, say `?next=` or `?returnUrl=`, without sufficient checking, instead of restricting the target to its own domain or an explicitly allowed list. On its own this looks harmless, but an attacker can use this vulnerability to send a link that visibly points to the trusted, real domain, but that actually redirects to an attacker-controlled phishing page after a harmless-looking intermediate step.

Running unserialize on untrusted input such as cookies, session data, or API payloads opens the door to PHP Object Injection and dangerous gadget chains that abuse magic methods like wakeup and destruct to execute arbitrary code. This article explains the mechanics, shows safer alternatives like json_decode, and covers proven deserialization patterns for production PHP and Magento applications.

The Cookie Store API replaces the error prone parsing of document.cookie with an asynchronous, promise based interface featuring structured cookie objects, change events and real service worker access. Anyone managing session cookies, consent banners or auth tokens will find a much more robust foundation in the Cookie Store API than manual string parsing.

A single stolen admin password today is enough to cause total damage in a Magento backend. This article shows how TOTP per RFC 6238, hashed backup codes, and phishing resistant WebAuthn/FIDO2 are implemented correctly at the technical level, and how Magento's native Two-Factor Auth module can be enforced for every admin user to close this gap.

Anyone running custom PHP applications without Symfony or Laravel has to build CSRF protection themselves. With random_bytes for token generation, hash_equals for constant time comparison and a clean session binding, robust CSRF protection can be built in a few lines of PHP, without any third party dependency.

ARG and ENV almost always end up visible in the final image, even after an apparent overwrite. BuildKit's --secret and --ssh flags let you provide credentials and SSH keys only transiently during a single RUN step, without them ever landing in a layer.

An insecurely implemented session is the most direct route to account takeover, no matter how strong the login itself is protected. This article explains how session ID regeneration, cookie flags, timeout strategies and secure session storage work together, and how Magento structurally separates frontend and admin sessions from one another.

A single forgotten API key in a commit is enough to expose credentials permanently, even if the file gets deleted in a later commit. This article shows how gitleaks and git-secrets catch secrets before they are committed, why an additional CI check is necessary, and which order of operations determines the damage after a real leak.

Row Level Security moves access rules out of the application layer and into the database itself, filtering every row automatically according to the current security context. Anyone securing multi-tenancy or tenant-sensitive application logic without Row Level Security relies on disciplined WHERE clauses in every single query, and that breaks sooner or later.

Applying unserialize() to untrusted data is one of the most dangerous patterns in PHP applications. Gadget chains made of seemingly harmless classes enable remote code execution merely by reconstructing an object. JSON, allowed_classes and signed payloads reliably close this gap.