appsec

A Deep Link Is an Unauthenticated Entry Point Into Your App

Anything can send one: a web page, a QR code, a message, another app on the device. With a custom scheme there is not even a guarantee the link reaches your app rather than someone else's.

Design the API Key So It Can Be Found When It Leaks

A high-entropy string with no marker is invisible to every secret scanner, which makes yours the product that finds out last. A few decisions about the format buy a great deal.

Anyone With the Link Is Not an Access Control

It is the absence of one, with a long identifier standing in for a decision about who should see the thing. Products ship it because customers need it, and then nobody can list what has been shared.

Best Practices

Localhost Is Not as Private as It Feels

Your machine is running more servers than you think, most with no authentication because localhost feels private. Any page you visit can send requests to them, on the machine holding your cloud credentials and SSH keys.

A WebSocket Is Authorised Once and Then Lives for Hours

The user is removed from the project, their role is downgraded, their session is revoked. The socket is still open and still receiving, because nothing re-evaluates a connection that was authorised in the past.

GraphQL Moved Your Authorisation Checks and Most Teams Left Them Behind

In REST an operation has one endpoint, so the check has one place to live. In a graph a field can be reached by many paths, and a check on the top-level query does not protect the same data reached as a nested field.

Your Search Index Is a Second Database With None of Your Access Controls

A missing clause in a database query returns too much. A missing clause in a search query returns everything, across every customer, ranked by relevance.

The CSV You Exported Runs on Someone Else's Machine

The value was stored safely, escaped correctly on every page, and never caused a problem. Then an administrator opens the export in a spreadsheet and the cell is not data any more.

Inbound Email Is an Unauthenticated API You Forgot You Built

Reply to a notification and it appears in the ticket. Forward a document and it imports. The From header is a string the sender chooses, and it is what most implementations key on.

Your PDF Generator Is a Browser You Handed to Your Users

Behind the invoice feature is a headless browser running inside your network, rendering markup a user influenced. Everything a browser does it will do: fetch URLs, load images, follow redirects. The only question is where it can reach.

The Invitation Flow Is an Access Grant Wearing a Growth Feature's Interface

Someone mistypes a colleague's address and a stranger is in that company's tenant, because the invitation worked exactly as designed. It is built early, for frictionlessness, by whoever shipped the collaboration feature.

Account Recovery Is the Weakest Authentication You Have

You require strong passwords and enforce MFA, then built a flow that lets someone with inbox access bypass all of it. Recovery exists to let in someone who cannot satisfy the normal requirements, so every control above it is capped by how well it is built.