The newest API Security resources are on the API Security page. For a reading order instead of a date order, see the API Security learning path.
| Date Added | Link | Excerpt |
|---|---|---|
| 2021-05-14 2021 | Creating an Authentication API with GolangUsing Gin & Nrok intermediate AuthN | This article outlines the process of building an authentication API using Golang, the Gin web framework, and Nrok for tunneling. It likely covers setting up a Gin server, implementing authentication logic (e.g., user registration, login, token generation), and using Nrok to expose the local development server for testing. The focus is on practical implementation steps for creating a functional authentication system. |
| 2021-05-06 2021 | CWE-598: Information Exposure Through Query Strings in GET Request beginner | CWE-598 describes the vulnerability where sensitive information is exposed through query strings in GET requests. This occurs when confidential data, such as credentials or personal details, is appended directly to the URL. Attackers can easily access this information through browser history, server logs, or by intercepting network traffic. This practice should be avoided, and sensitive data should be transmitted using more secure methods like POST requests or encrypted channels. |
| 2021-05-06 2021 | XSS Through Parameter Pollution intermediate XSS | This content explains how Cross-Site Scripting (XSS) vulnerabilities can be exploited through parameter pollution. This technique involves injecting malicious scripts by manipulating multiple parameters within a single request. Attackers can leverage this to bypass security filters and execute arbitrary code in a user's browser. The article details the methods used for such attacks and emphasizes the importance of robust input validation to prevent them. |
| 2021-05-04 2021 | OAuth 2.0: Security Considerations beginner 6 min read AuthN | Reference detailing OAuth 2.0 security considerations, including common mistakes in Classic Web Applications, Single Page Applications, and Mobile Applications. It elaborates on design choices, implementation pitfalls, and exploitation techniques, referencing RFCs like 6749 and 7636. The resource utilizes a sample "gallery" application and its integrations like "photoprint" and "mypics" to illustrate secure OAuth 2.0 flows, such as authorization code grant with PKCE, and discusses token introspection and revocation. |