Sourced / Security blog
Web App Security
Website, API and AI security. Clear scope, useful evidence, and practical fixes.
30 articles / Page 1 of 2
- Web App Security
Restrict return URLs and external redirects
Review return-to parameters without trusting URL prefixes. Define accepted destinations, fallback behavior, and browser-visible redirect tests.
- Web App Security
Audit CORS rules against real browser origins
Create an origin and credential matrix for your API. Check preflight behavior, actual responses, cache variation, and unexpected origin matches.
- Web App Security
Check file access before issuing a download
Trace a file identifier to its owner, accepted version, and download response. Test revoked access, direct-object paths, and the limits of signed URLs.
- Web App Security
Authorize WebSocket actions after the connection opens
Map message types to resources and current permissions. Test subscriptions, role changes, session expiry, and cross-tenant messages on an existing connection.
- Web App Security
Check framing protection on account actions
Inventory pages that change account state and verify their frame policy. Test approved embedding separately from blocked framing on sensitive screens.
- Web App Security
Set upload budgets across requests and processing
Define per-file, request, storage, and processing limits. Test streamed uploads, concurrent reservations, partial cleanup, and legitimate near-limit files.
- Web App Security
Check browser origins before WebSocket upgrades
Define a WebSocket handshake policy for browser and machine clients. Test exact origins, missing origin handling, authentication, and proxy behavior.
- Web App Security
Constrain URL fetches in import and preview features
Define which destinations an application may fetch. Review URL parsing, resolved addresses, redirects, response limits, and the worker's network access.
- Web App Security
Review output encoding where user content renders
Trace user-controlled values into text, attributes, links, and rich content. Build rendering assertions that preserve valid text without allowing execution.
- Web App Security
Set archive extraction boundaries before unpacking
Review member paths, links, expansion limits, and cleanup for uploaded archives. Use a controlled scratch directory and small fixtures to verify containment.
- Web App Security
Limit what image processing workers can reach
Review converter formats, filesystem access, credentials, and resource limits. Verify the worker's actual restrictions with harmless boundary tests.
- Web App Security
Record authentication events without recording secrets
Create a minimal authentication event schema. Verify login, recovery, and factor-change records while excluding credentials, session values, and private request bodies.
- Web App Security
Make webhook effects safe to repeat
Design an event-processing record that survives retries and worker crashes. Test concurrent delivery, durable acceptance, and downstream side effects.
- Web App Security
Separate upload names from storage identity
Treat the original filename as display data. Define server-owned storage keys, collision behavior, Unicode handling, and safe download-name serialization.
- Web App Security
Check session changes at login and elevation
Build a session-transition test record for login, privilege elevation, and logout. Check that an old session identifier cannot inherit new authority.
- Web App Security
Review CSRF protection for browser form actions
Map cookie-authenticated mutations to their CSRF controls. Test missing tokens, untrusted origins, and legitimate forms without changing real customer data.
- Web App Security
Keep uploads unavailable until checks finish
Define pending, accepted, rejected, and expired upload states. Bind check results to immutable bytes and test publication races and worker failures.
- Web App Security
Set login attempt limits without broad lockouts
Design account and network limits with a recovery path. Test shared-network users, distributed attempts, reset behavior, and bounded operational failures.
- Web App Security
Define webhook replay and delivery-age checks
Separate signature freshness from duplicate event processing. Build tests for stale signed deliveries, retries, clock skew, and endpoint-specific replay policy.
- Web App Security
Roll out CSP with a reviewable enforcement plan
Move a Content Security Policy from observation to enforcement. Track script owners, violation causes, staged rollout decisions, and rollback evidence.
- Web App Security
Build a web application security release gate
Tie release decisions to changed security boundaries. Require named evidence for authentication, uploads, webhooks, headers, and unresolved exceptions.
- Web App Security
Review outbound webhook destination changes
Control where customer-configured callbacks can send data. Bind delivery jobs to reviewed endpoint versions and check DNS, redirects, secrets, and retries.
- Web App Security
Review password reset as an account state change
Map reset requests, token use, password replacement, and session handling. Test expiry, reuse, enumeration, and recovery without real customer accounts.
- Web App Security
Set cache policy for private account responses
Separate public assets from private responses. Verify browser and shared-cache behavior with two synthetic accounts and explicit storage decisions.