Collaborate Disseminate
As I was reading the session fixation article on OWASP, I was thinking that the only way for my server to refuse a cookie set by a rogue script would be for my server to know that the browser sent a request without the HTTP-O… Continue reading Is there a way to know that a cookie is "HTTP Only" on the first user request?
In OAuth2 reference, section 4.1.2, we have this paragraph about the code token:
code
REQUIRED. The authorization code generated by the
authorization server. The authorization code MUST expire
shortly after it… Continue reading How long should the OAuth2 requirement to delete Access and Refresh Tokens for code reuse last for?
I have a fail2ban rule for Apache2 logs that which looks like this:
[Definition]
failregex = ^[^ ]+ <HOST> .* \[\] “[^\”]*” 408 \d+
This will detect the 408 errors which happen when a TCP connection times out.
The f… Continue reading Blocking slowloris using fail2ban, what are the correct parameters?