Page 8 - Security/OWASP

An API token stored in plaintext in the database is a ticking time bomb. This guide shows the complete pattern for API token authentication in Symfony, from secure generation through hashed storage to rotation, scopes and a working revocation mechanism.

API keys unlock interfaces for partners, marketplaces, and internal services, yet poorly managed keys remain one of the most common entry points for data breaches. This article shows how to generate API keys with sufficient entropy, scope them to minimal permissions, rotate them without downtime, and revoke them immediately on suspected compromise, with practical guidance for Magento backends.

HTTP request smuggling arises when an upstream proxy or load balancer and the backend server behind it interpret the same HTTP message differently, particularly regarding exactly where one request ends and the next begins, letting an attacker smuggle a hidden second request into the connection that the backend mistakenly interprets as a standalone request from a different, completely uninvolved user. This vulnerability class is especially dangerous because it doesn't live in the application itself, but in the infrastructure interaction between two components that are each, individually, correctly implemented.

Automatically binding request data to entities or models is convenient, but it can let an attacker send fields like is_admin along with a request and overwrite them. We explain allowlist versus blocklist thinking and walk through a concrete Symfony example using DTOs instead of direct entity binding.

An HTTP security header such as the Content Security Policy or the X-Frame-Options header usually gets carefully configured once, often as part of a security audit, and then barely gets touched again. This exact calm turns into a trap the moment a later web server refactor, a new CDN, or a changed Nginx configuration accidentally shortens, removes, or misconfigures the header, since normal storefront operation gives nobody an immediate signal that a protection mechanism has silently vanished. Adding a fixed assertion for the most important security headers to the existing end-to-end test suite instead lets such a regression surface at the very next test run, long before it turns into a real security problem in production.

A GraphQL API without a complexity limit is an open door for overloading attacks. Depth limits, field-specific costs and complexity budgets are the three layers that stop a single query from occupying the server for seconds, or for minutes, if the schema has enough expensive fields.

Running forms and state-changing endpoints without real CSRF protection means relying solely on the browser's session cookie, opening the door to forged requests from other sites. Synchronizer tokens, double-submit cookies, the SameSite attribute, and Magento's form_key show how to close that gap reliably.

Feature flags enable continuous deployment without feature branching: code is merged, but features stay disabled until they're ready. A homegrown solution built on Symfony's own building blocks is leaner, faster and fully under your control, with no external dependencies and no vendor lock-in.

Without rate limiting, a single client can overwhelm a Nuxt Server Route with thousands of requests per second, whether from a misconfigured client, a bot, or a targeted attack. Token bucket algorithms, Redis based limiting, and a correct 429 error format protect the API without slowing down legitimate users.

A DNS record pointing to a long decommissioned cloud service looks harmless, yet it is one of the most underrated vulnerabilities on the web. We explain how attackers take over dangling CNAME records, which cloud services are hit most often, and how a systematic DNS audit closes the gap before anyone exploits it.