Page 23 - Security/OWASP

Anyone who checks user input only against known attack patterns inevitably misses the next variant. This article explains why allowlist validation beats every blocklist, how to correctly use PHP's filter_var function, which pitfalls Magento's form validation holds, and why validation and sanitization are strictly separate tasks with different goals.

GraphQL authorization does not end at the query check. Sensitive fields such as email addresses, order histories, and admin-specific data must be secured at the field level, inside the resolver context, not just in the schema. This article shows how that works in practice.

A database password in a .env file or a pipeline variable is a secret that eventually ends up in a log, a backup, or a history file. Vault secrets that Bash scripts fetch, verify, and never persist anywhere close exactly that gap, including dynamic database credentials and automatic rotation.

Password hashing directly determines how expensive it is for an attacker to crack each individual password after a database leak. Argon2id is now considered the preferred algorithm because it is memory-intensive and therefore resistant to GPU- and ASIC-backed attacks, while bcrypt with its CPU-bound cost function has worked as a solid standard for decades. This article shows how to correctly configure, salt, pepper, and migrate both algorithms in production using the PHP standard API password_hash() and password_verify().

File permissions in Bash scripts often arise only implicitly through the inherited umask instead of being set explicitly, and that is exactly what leads to unnecessarily broad access rights. This article shows how umask, chmod, and chown are applied systematically, which risks SUID and SGID pose in automation scripts, and how a dedicated audit script reliably checks file permissions.

In many GraphQL projects, the schema is the only contract between frontend and backend teams, yet nobody takes responsibility for versioning, sharing or reviewing it. Introspection, SDL and schema registries are the three building blocks that let teams turn the schema into a genuine single source of truth.

File Integrity Monitoring with AIDE detects unauthorized changes to critical system and configuration files before they become an undetected security incident. Setting up baseline, rules and automated checks correctly delivers a reliable early warning system that simultaneously satisfies central compliance requirements.

Clickjacking tricks users with an invisible iframe layered over a real page, making them unknowingly trigger critical actions like deleting an account or confirming a transfer. Classic JavaScript frame-busting can be bypassed, while X-Frame-Options and the CSP directive frame-ancestors work as HTTP headers that reliably stop a page from being framed at all.

Log injection, also called log forging, arises when an application writes user-controlled input into log files unfiltered, and an attacker deliberately injects control characters like line breaks (`\r\n`) to visually and structurally split a single, actually contiguous log entry into multiple, seemingly standalone entries. These forged additional entries can be crafted to look like legitimate, harmless system events, causing actual malicious activity to get buried in a flood of forged distraction entries, or deliberately misleading forensic analysis after a security incident.

Every Composer and npm dependency is a silent trust contract with someone else's code. Typosquatting packages, hijacked maintainer accounts, and malicious install scripts inject attacks straight into build pipelines. This article covers real attack patterns and concrete countermeasures for PHP and Magento projects.