Collaborate Disseminate
I have read about X-Content-Type-Options and it says often that it protects against IE mime sniffing problems.
I am wondering if in 2021 it is still valid and a problem for modern browsers? In other words, will it be beneficial for my web … Continue reading Is mime-sniffing still something to protect against with modern browsers (with X-Content-Type-Options)?
I am creating a web application that is sending sensitive data between servers. I need to take user inputted web form data from website 1 (abc.com) and post the data to website 2 (xyz.com/api). Website 2 will capture the data from websi… Continue reading Sending Post Requests Server to Server
I have a website where I am blocking it from being loaded via iframe into other websites.
What I want is to keep this in place, but allow certain URLs from my website, to be iframed anywhere.
For example, allowing these to be iframed:
htt… Continue reading X-Permitted-Cross-Domain-Policies – allow certain URL patterns
Imagine that there is server required authentication for getting an access to some endpoint.
And developer added some logic to bypass the authentication: if server recieve HTTP header give_me_access=true, then server answers without requir… Continue reading Is there way to know what headers can be accepted by HTTP server?
Each facebook user gets legitimate facebook emails with a fixed
Return-Path: notification+ABC123@facebookmail.com
header. I.e., Bob will always get mails from ABC123, and Wilma from EFG456.
There is no way a phisher / spammer would know w… Continue reading How to update the Return-Path that Facebook sends with?
After authenticated by Google, a client browser attaches the idToken from Google to an application API server. Assuming google-auth-library auto-refresh an expired token, it now needs to send it back in header to client browser so new requ… Continue reading How risky it is if a server allows client Javascript access to say an access token in header?
i got this mail in my mailbox orange.fr , i took a look at the headers there is no headers from smtp , how could this be possible ?
normally mail should looks like this one
Continue reading Inboxed spam mail without SMTP trail and introduction?
I am using x-frame-options sameorigin header to prevent some of my websites from being loaded in iframes. Is this a foolproof method to prevent iframe loading?
There have been several old threads on stackoverflow that discuss employing fra… Continue reading Is frame busting javascript required despite x-frame-options
Recently, during a pen-testing exercise, I noticed that the target server responded with multiple "Server" fields in the header. I was wondering what it could mean and if oddity is somehow interesting from a pen-tester’s perspect… Continue reading Multiple server fields in HTTP Response
Should be the header Expect-CT be set by a server that exposes a SOAP web service over SSL?
Continue reading Should a server set Expect-CT for a SOAP web service?