Page 12 - Security/OWASP

Different execution times in string comparisons can let attackers guess secret values, such as API keys or HMAC signatures, byte by byte. We explain the underlying mechanism, show hash_equals() as the fix in PHP, and cover which comparisons are actually timing sensitive.

Cross Site Request Forgery is considered a solved problem by many teams the moment an application moves to a single page architecture with fetch instead of classic forms. In reality the risk merely shifts as long as session cookies are involved in authenticated API calls, and it stays real, requiring a deliberate combination of double submit cookie, the SameSite attribute and custom headers.

The default Alpine.js build evaluates expressions in x-data and x-on through new Function(), which gets blocked immediately under a strict Content Security Policy without unsafe-eval. The dedicated Alpine.js CSP build replaces that evaluation with a safe expression parser, making reactive components possible even in environments with the strictest security policy.

ReDoS, short for regular expression denial of service, arises when a regular expression exhibits behavior called catastrophic backtracking on certain, deliberately crafted inputs, in which the time needed for evaluation grows exponentially instead of linearly with input length, so that an input only a few hundred characters long can block the regex engine for seconds, minutes, or practically indefinitely. Since regular expressions are often used prominently for input validation, say for email or format checks right at the start of request processing, a single vulnerable regex can be enough to bring down an entire application with just a handful of requests.

The free Magento Security Scan Tool automatically checks publicly reachable stores for known vulnerabilities, risky file permissions, and accidentally exposed sensitive files such as .git or .env files. This article shows how to register a store correctly, set up recurring scans, prioritize findings properly, and understand why the tool never replaces a real penetration test.

Upload forms rank among the most dangerous entry points in web applications, because attackers craft files specifically to pass every superficial check. Relying solely on file extension and content type opens the door to web shells and executable code. This article shows how magic byte validation, secure storage outside the webroot, filename sanitization, and image re-encoding build genuine protection.

Firewalls, scanners and SIEM systems alone do not prevent security incidents when staff click phishing emails or hand over credentials carelessly, because people remain the most exploited attack vector. This article shows how teams build a real security culture: through hands-on onboarding, short recurring training, fair phishing simulations and a blame-free reporting culture that surfaces incidents early instead of hiding them.

Without resilient database access auditing, all that remains after a security incident is guessing: which rows were read, who changed a value, and how long a suspicious access has already been going on. Trigger-based logging, pgAudit, and immutable storage turn this uncertainty into a traceable, defensible record that also satisfies compliance requirements such as GDPR or PCI-DSS.

AI assistants like Claude speed up development but also carry over insecure patterns from training data, such as missing input validation, outdated crypto functions, or permissive default settings. Targeted security prompting and a review process that treats AI code like any other human contribution systematically reduce these risks.

An open GraphQL endpoint lets any client formulate arbitrary queries against the schema, including ones never intended for production use. Query whitelisting flips this principle: only previously known, reviewed queries get executed, everything else is rejected before it ever reaches a resolver.