Web Security

One open Introspection Query let me list the entire GraphQL schema. A real pentest case of a common but costly setup mistake.

One badly set cookie is enough for an attacker to pretend to be you. Meet the three lines of defense (Secure, HttpOnly, SameSite) and how to turn them on.

How does one string split by dots hold up the login for modern websites? Breaking down the three parts of a JWT, and the traps to avoid.