PKCE: testing authorization code interception locallyPKCE: testing authorization code interception locally PKCE (Proof Key for Code Exchange, RFC 7636) makes a stolen authorization code useless on its own. In our local toy server without PKCE, a party h10 min read·excessionlabs.hashnode.dev1h ago
Row level security: three Postgres mistakes, testedRow level security: three Postgres mistakes, tested Row level security (RLS) is a PostgreSQL feature that limits which table rows each role can read or write, based on policies. In a throwaway Postgre9 min read·excessionlabs.hashnode.dev12AA19h ago
GraphQL introspection: disabling it leaves the field openGraphQL introspection: disabling it leaves the field open GraphQL introspection lets a client ask the server for its whole schema. Turning it off hides the field list, but a client that knows or guess9 min read·excessionlabs.hashnode.dev19h ago
SSRF: reproduce, bypass, and fix a preview endpointSSRF: reproduce, bypass, and fix a preview endpoint Server-side request forgery (SSRF) is a flaw where a server fetches a URL chosen by the caller, so the caller can reach hosts that only the server c9 min read·excessionlabs.hashnode.dev19h ago
