Sourced / Security blog
Web App Security
Website, API and AI security. Clear scope, useful evidence, and practical fixes.
30 articles / Page 2 of 2
- Web App Security
Set secure flags on session cookies
Inspect session cookies across login, renewal, and logout. Record transport, script access, host scope, and cross-site behavior in one worksheet.
- Web App Security
Separate uploaded bytes from application content
Map upload storage, processing, and serving identities. Verify that uploaded files cannot become executable site content or bypass the download policy.
- Web App Security
Validate uploaded file types with explicit evidence
Compare allowed extensions, declared MIME types, and parser results. Build a bounded upload test set that checks mismatches without using live malicious files.
- Web App Security
Verify security headers across real response paths
Build a route and response matrix for browser headers. Check edge delivery, errors, downloads, and policy meaning rather than counting header names.
- Web App Security
Verify an email change before moving account recovery
Treat email changes as sensitive identity transitions. Define pending state, reauthentication, address confirmation, notifications, and concurrent-change behavior.
- Web App Security
Document OpenAPI Webhooks and Verify Inbound Signatures
Model OpenAPI 3.1 webhook direction, payloads, and delivery rules, then verify raw-body signatures, tenant mapping, retries, and duplicates.