Practical security learning, defensive thinking, web security, privacy, and risk management without claiming final answers.
Client IPs Behind a Reverse Proxy - Trust the Connection Before the Header An application behind a reverse proxy faces an awkward choice. If it records only the network peer, every request may appear to come from the proxy. If it accepts a header such as X-F…
Read article
A small PHP application may need only four ordinary database actions: read a row, insert one, update it, and sometimes delete it. Yet its c…
A password reset form often looks like a small feature: accept an email address, send a link, and let the user choose a new password. But t…
A password alone protects an account only as long as the password remains secret. Reused passwords leak in one breach and are tried elsewhe…
A small PHP application eventually needs a database password, an API token, or a key for signing messages. Where should that value live? Pu…
A settings form can require a valid login and still accept a request the user never meant to send. The session cookie tells the server whic…
A login form can verify the right password and still leave the account resting on a weak session. The difficult part begins after authentic…
A file upload form looks like a small feature: receive a file, move it into a directory, and save its name. The difficult question begins o…
The first SSH connection to a server often pauses before asking for a password or using a user key. It shows a fingerprint and asks whether…
A personal domain may send a password reset through a web host, a contact-form reply through a mailbox provider, and a newsletter through a…
