Practical security learning, defensive thinking, web security, privacy, and risk management without claiming final answers.
A browser console says that a request was “blocked by CORS.” The API may still return 200 OK in a terminal, and adding Access-Control-Allow-Origin: * may appear to make the error disappear. What, exactly, did that header permit? The useful answer is narrower…
Read article
A small PHP application sometimes needs a tool that PHP itself does not provide: an image converter, a document renderer, a media probe, or…
A small PHP application may need to import an image, preview a link, test a webhook endpoint, or retrieve a remote feed. The feature sounds…
There is a specific moment in the life of a small web application when the login form starts to feel like a liability rather than a feature…
Client IPs Behind a Reverse Proxy - Trust the Connection Before the Header An application behind a reverse proxy faces an awkward choice. …
A small PHP application may need only four ordinary database actions: read a row, insert one, update it, and sometimes delete it. Yet its c…
A password reset form often looks like a small feature: accept an email address, send a link, and let the user choose a new password. But t…
A password alone protects an account only as long as the password remains secret. Reused passwords leak in one breach and are tried elsewhe…
A small PHP application eventually needs a database password, an API token, or a key for signing messages. Where should that value live? Pu…
A settings form can require a valid login and still accept a request the user never meant to send. The session cookie tells the server whic…
