Page 22 - Security/OWASP

GraphQL has no HTTP equivalent for business errors. Anyone who models business errors as resolver exceptions, fails to distinguish transport errors from network problems, and ignores extensions.category ends up with error handling that forces the frontend to react to heuristics instead of structure.

Standard logs like syslog or journald only show what applications choose to log themselves, not who changed /etc/passwd or how a process elevated its privileges. auditd hooks directly into the Linux kernel audit subsystem, logs syscalls and file access without gaps, and makes changes forensically traceable with ausearch and aureport, including rules for sensitive configuration files and privilege escalation.

Without additional protective measures, GraphQL APIs are vulnerable to overloaded queries, introspection attacks, batching DoS, and data leaks through resolvers that are too permissive. This security review shows concrete attack scenarios and the matching countermeasures.

Choosing the right authentication mechanism decides the security and integration effort of a PHP API. This article shows when API keys are enough, how JWT signatures really work, and when the extra effort of OAuth2 truly pays off, with secure storage and full code examples.

Vulnerabilities in production dependencies tend to get taken seriously, while test and dev dependencies like PHPUnit plugins or coverage tools are often ignored. Yet exactly these packages run with full privileges in the CI/CD pipeline and form a real entry point for supply chain attacks, one composer audit can uncover deliberately.

A webhook endpoint is, by definition, publicly reachable and accepts data from an external service without the ability to apply the application's usual login mechanism. Without cryptographic signature verification, anyone who knows the URL can in principle inject arbitrary payloads and trigger business actions such as a payment confirmation or an order status change. This article shows how to build a dedicated webhook controller in Symfony, how to verify an HMAC signature safely against timing attacks using hash_hmac and hash_equals, when the built-in Symfony webhook component fits, and how to process repeated deliveries of the same event idempotently.

The restricted shell rbash blocks cd, PATH changes, and calling programs through a path containing a slash. That is enough for simple, benign restrictions like an SFTP replacement, but it can be bypassed with documented techniques relatively easily. Anyone using rbash should know exactly what it covers and what needs additional hardening.

In project discussions, E2E tests and penetration tests occasionally get treated as though a sufficiently comprehensive E2E test suite could eventually make a dedicated penetration test unnecessary, which rests on a basic misunderstanding of each test type's actual intent: an E2E test checks whether an application works as expected along known, previously defined user paths, while a penetration test deliberately tries to abuse the application through paths no development team considered while writing the test cases. This fundamentally different direction of thinking makes both test types valuable, complementary building blocks of a quality assurance strategy, but neither can structurally replace the other.

A correctly configured TLS stack determines whether customer data, payment information, and sessions in a Magento store are actually protected or only appear to be. This article explains how the TLS handshake works, why outdated protocol versions and weak cipher suites are a real risk, how certificate chains are validated correctly, and how Let's Encrypt, HSTS, and hardened server configurations fit together.

A secret that has ever been committed stays reachable in git history even after the file gets deleted. This article explains why that is, how pre-commit hooks and CI scanners stop leaks before they happen, and which order matters after a real incident: rotate the credential first, then clean up the history.