Collaborate Disseminate
JWE is often used in REST APIs to send encrypted messages. However, I need to send a file that could be GBs in size. I have tried to find any information about the maximum length limit of the plaintext that can/should be the … Continue reading Large encrypted files to be sent in REST API response
The scenario is that the same code library is used by both client and server to encrypt/decrypt messages. The server application uses the library’s encryption function to encrypt some content (that needs to be protected) and … Continue reading Content-Type for a JWE Compact Serialization payload
The scenario is that the same code library is used by both client and server to encrypt/decrypt messages. The server application uses the library’s encryption function to encrypt some content (that needs to be protected) and sends the seri… Continue reading Content-Type for a JWE Compact Serialization payload
I am currently building a RESTful API that will be used for a web and mobile app. Authentication to the API will be done using JSON Web Tokens.
When using JWT, we can use the exp claim to expire the token after a specific ti… Continue reading Preventing replay attacks with JWT
It’s sometimes possible to use an alternate encoding to get around security checks (CAPEC-267). While the JSON spec may be strict on what is valid, popular parsers don’t necessarily conform perfectly [1].
My question is thu… Continue reading Are JSON key names vulnerable to alternate encoding (CAPEC-267) attacks?
I am testing web application for which business actions are done by sending JSON requests like for example:
POST /dataRequest HTTP/1.1
Host: test.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:55.0) Gecko/20100101
Firefox/55.0
A… Continue reading CSRF with JSON POST when Content-Type must be application/json
Recently, i came across many web applications that are using callback parameters to retrieve JSON formatted data. This makes web application vulnerable to JSONP Injection attack. So what is the effective way to prevent JSONP … Continue reading How to Prevent JSONP injection
I am quite confused while understanding these two vulnerabilities.
How are JSONP-related vulnerabilities different from JSON Hijacking?
Continue reading Is JSON Hijacking different than JSONP injection?
I am building the API for a SPA and Chrome plugin using Rails, and I am inclined to go use Secure HTTPOnly cookies for authentication because:
This is the default solution for standard Rails auth libraries like Devise and S… Continue reading CSRF Protection for JSON API with Cookie Auth
Aidan Finn argues why knowledge of how infrastructure works is still as important as ever.
The post The Cloud — Don’t Be the Driver, Be the Mechanic appeared first on Petri.
Continue reading The Cloud — Don’t Be the Driver, Be the Mechanic