Showing 1–5 of 5 articles
Check who is allowed to call your webhook
A webhook’s payload and familiar endpoint name do not prove who sent it. Validate the sender using its supported scheme, handle retries deliberately, and authorize the resulting business action.
Read the visual guide
Do not put a secret API key inside a mobile app
An application you distribute to users cannot reliably hide a shared secret embedded in its code or resources. Put privileged authorization behind an appropriate server-side boundary.
Read the visual guide
When your system acts with the wrong person’s authority
A service may have more access than the person asking it to act. It must check the caller’s authority before using its own powerful identity on that person’s behalf.
Read the visual guide
SSRF explained: when a server fetches a destination it should not
A server-side request feature can reach resources that the user cannot directly access. Review allowed destinations and the authority available to the fetching service.
Read the visual guide
Broken access control: can one user reach another user’s data?
Being signed in should not give a person access to every record. The server must check permission for the specific object and action on every request.
Read the visual guide