Page 7 - Security/OWASP

Servers where sudo is granted blanket ALL=(ALL) ALL access blur the line between a regular user and root entirely and make every privilege grant impossible to control. This article shows how to edit sudoers safely with visudo, how readable aliases enable narrow grants, when NOPASSWD is justified, and how complete logging keeps every privileged command accountable.

Authentication in GraphQL is not a special case, it is part of every resolver that touches user-specific data. Anyone who fails to explicitly model token validation, session context and field-precise access control is building security gaps into the schema before the first query ever reaches production.

Many REST teams rely on simple content-type checks or the assumption that cross-site requests only ever touch GET requests. GraphQL bundles queries and mutations behind a single POST endpoint, rendering these assumptions worthless. Anyone running a GraphQL API with cookie-based sessions needs explicit CSRF protection that accounts for the specifics of that single endpoint.

Behind every login on Linux, whether via SSH, sudo or a local console, sits a configurable stack of authentication modules. PAM fully decouples applications from the concrete authentication logic and makes it possible to set up login lockouts, password policies and two factor procedures without changing a single line in the application itself.

API keys for internal service-to-service communication have a structural problem: a stolen key can be used from anywhere, without the server noticing that the request does not actually come from the expected service. Mutual TLS solves this by having both sides of the connection identify each other via certificate, not just the server to the client.

Anyone managing backups, configuration files, and API secrets from the shell eventually runs into OpenSSL and GPG. This article shows how to use both tools safely and practically in Bash scripts, from symmetric encryption through GPG signing to automated certificate checks without any interactive password prompts.

Lone surrogates from URL parameters, file uploads, or third party APIs can crash entire function chains. isWellFormed() and toWellFormed() finally provide a native safeguard.

Most successful attacks on Linux servers exploit open SSH password logins, missing firewall rules, and outdated packages, not sophisticated zero-day exploits. This article shows a practical hardening baseline that closes most of the attack surface with minimal effort, without making operations unnecessarily harder.

Math.random() is unsuitable for IDs, since it relies on a predictable pseudo-random generator. crypto.randomUUID() delivers genuine UUID v4 values from a cryptographically secure random generator, with no external dependencies, equally in the browser and in Node.js.

A correctly configured firewall is the first line of defense for any server on the internet. This article shows in practice how iptables works as the kernel packet filter, how ufw sits on top as a simple frontend, which baseline rules a production web server actually needs for SSH, HTTP, and HTTPS, and how to reliably verify that these rules stay active and survive every reboot intact.