BestHub
Sign in
Tagged articles

Web Security

360 articles · Page 2 of 4
Sohu Tech Products
Sohu Tech Products
Apr 17, 2024 · Information Security

Understanding HTTPS and SSL/TLS: A Comprehensive Guide to Web Security

HTTPS secures web traffic by combining symmetric and asymmetric encryption, digital signatures, and certificate authorities within the TLS protocol to ensure confidentiality, integrity, authentication, and non‑repudiation, replacing insecure HTTP and becoming mandatory for modern browsers, servers, and platforms despite earlier concerns about cost and complexity.

CADigital CertificateHTTPS
0 likes · 17 min read
Understanding HTTPS and SSL/TLS: A Comprehensive Guide to Web Security
Spring Full-Stack Practical Cases
Spring Full-Stack Practical Cases
Apr 7, 2024 · Frontend Development

Mastering CORS in Spring Boot: From Basics to Full Implementation

Learn how Cross-Origin Resource Sharing (CORS) works, when it’s needed, the role of preflight requests, essential HTTP headers, and step-by-step Spring Boot solutions—including @CrossOrigin annotations, global configuration, and custom filters—to securely enable cross-domain calls in your applications.

CORSCross-OriginHTTP headers
0 likes · 11 min read
Mastering CORS in Spring Boot: From Basics to Full Implementation
Liangxu Linux
Liangxu Linux
Mar 25, 2024 · Information Security

How to Use Gzip Compression to Overload Web Crawlers (Gzip Bomb Tutorial)

This guide shows how to create a tiny gzip‑compressed file, serve it with FastAPI, and exploit automatic decompression in Python's requests library to force a crawler to consume massive memory, effectively turning compression into a denial‑of‑service weapon.

CompressionDenial of ServiceFastAPI
0 likes · 7 min read
How to Use Gzip Compression to Overload Web Crawlers (Gzip Bomb Tutorial)
AI Illustrated Series
AI Illustrated Series
Feb 9, 2024 · Information Security

Why Does a POST Sometimes Send Two Requests? A Deep Dive into CORS Preflight

This article explains why browsers may issue a duplicate POST request by exploring the same‑origin policy, the mechanics of CORS, the criteria for simple requests, the structure of preflight OPTIONS requests, credential handling, and how development tools like Webpack Dev Server bypass these restrictions.

CORSCross-OriginPreflight Request
0 likes · 13 min read
Why Does a POST Sometimes Send Two Requests? A Deep Dive into CORS Preflight
Bilibili Tech
Bilibili Tech
Feb 6, 2024 · Frontend Development

Advanced Interception Techniques in Front-End Development: API Overriding, Service Workers, and Sandbox Strategies

Advanced interception techniques—such as overriding browser APIs, using ServiceWorkers, employing MutationObservers, creating Proxy‑based sandboxes, and configuring server‑side gateways—provide a flexible middle layer for error reporting, request monitoring, micro‑frontend isolation, and remote debugging, while demanding careful adherence to security policies.

InterceptionJavaScriptProxy
0 likes · 16 min read
Advanced Interception Techniques in Front-End Development: API Overriding, Service Workers, and Sandbox Strategies
php Courses
php Courses
Jan 29, 2024 · Information Security

Guide to Preventing LDAP and SQL Injection Attacks in PHP

This article explains the principles, provides code examples, and outlines preventive measures for LDAP and SQL injection attacks in PHP, helping developers understand how these vulnerabilities work and how to secure their web applications through input validation, parameter binding, and access control.

Input ValidationLDAP injectionSQL injection
0 likes · 6 min read
Guide to Preventing LDAP and SQL Injection Attacks in PHP
Java Tech Enthusiast
Java Tech Enthusiast
Jan 10, 2024 · Information Security

Cross-Origin Resource Sharing (CORS) and Same-Origin Policy Explained

Cross-Origin Resource Sharing (CORS) extends the Same-Origin Policy by permitting controlled cross‑origin requests through simple and preflight flows, using specific headers and credential rules, thereby balancing web security against threats like XSS, CSRF, and injection attacks while enabling safe resource sharing.

CORBCORSCross-Origin Requests
0 likes · 10 min read
Cross-Origin Resource Sharing (CORS) and Same-Origin Policy Explained
MaGe Linux Operations
MaGe Linux Operations
Jan 6, 2024 · Information Security

Understanding XSS: Types, Risks, and Effective Defense Strategies

This article explains what Cross‑Site Scripting (XSS) is, describes its various types and the severe threats it poses, and provides comprehensive defense techniques—including input/output validation, HTML/JavaScript encoding, HttpOnly cookies, and secure handling of URLs, CSS, and rich‑text content—to protect web applications from XSS attacks.

CSRFHTML EncodingInput Validation
0 likes · 31 min read
Understanding XSS: Types, Risks, and Effective Defense Strategies
Architect's Guide
Architect's Guide
Jan 6, 2024 · Information Security

Understanding Same-Origin Policy and CORS in Web Development

This article explains the same‑origin policy, its role in protecting web applications, how browsers enforce it through DOM, web‑data, and network restrictions, and how Cross‑Origin Resource Sharing (CORS) and preflight requests enable controlled cross‑origin communication while maintaining security.

CORSCross-OriginHTTP
0 likes · 12 min read
Understanding Same-Origin Policy and CORS in Web Development
Sohu Tech Products
Sohu Tech Products
Dec 20, 2023 · Information Security

Understanding Self‑XSS Warnings in Chrome DevTools

Chrome DevTools now shows a Self‑XSS warning when an inexperienced user tries to paste code, using a simple heuristic that checks for at least five console‑history entries, requiring the user to type “allow pasting” before execution, to protect against social‑engineered attacks that could steal data or hijack accounts.

Browser WarningChrome DevToolsSelf-XSS
0 likes · 7 min read
Understanding Self‑XSS Warnings in Chrome DevTools
Code Ape Tech Column
Code Ape Tech Column
Sep 28, 2023 · Information Security

Understanding Same-Origin Policy and CORS in Web Development

This article explains the browser's Same-Origin Policy, its impact on DOM, data, and network access, and how Cross-Origin Resource Sharing (CORS) and preflight requests enable controlled cross-origin communication while preserving security.

CORSCross-Origin RequestsSame-Origin Policy
0 likes · 11 min read
Understanding Same-Origin Policy and CORS in Web Development
MaGe Linux Operations
MaGe Linux Operations
Sep 23, 2023 · Information Security

How to Prevent SQL Injection in Java Projects: From PreparedStatement to Nginx Filters

This article explains what SQL injection is, demonstrates a vulnerable example, and presents four practical defenses for Java applications—including PreparedStatement, MyBatis #{} placeholders, request‑parameter filtering, and Nginx reverse‑proxy rules—complete with code snippets and configuration details.

JavaMyBatisPreparedStatement
0 likes · 8 min read
How to Prevent SQL Injection in Java Projects: From PreparedStatement to Nginx Filters
Liangxu Linux
Liangxu Linux
Sep 23, 2023 · Information Security

Why Chrome Is Switching All Sites to HTTPS by Default

Chrome’s new HTTPS‑First experiment automatically upgrades HTTP requests to HTTPS, warns about insecure downloads, and rolls out gradually, aiming to make the web safer by encrypting the majority of traffic while still handling edge cases gracefully.

ChromeHSTSHTTPS
0 likes · 6 min read
Why Chrome Is Switching All Sites to HTTPS by Default
Sohu Tech Products
Sohu Tech Products
Sep 20, 2023 · Information Security

How to Secure Your Website with the Open‑Source SafeLine WAF in One Command

This article explains what a Web Application Firewall (WAF) is, introduces the open‑source SafeLine WAF, and provides step‑by‑step instructions for containerized installation, describes its architecture and core security capabilities such as semantic attack detection, IP intelligence, traffic control, and high‑performance protection for web sites.

DockerInstallationNginx
0 likes · 8 min read
How to Secure Your Website with the Open‑Source SafeLine WAF in One Command
Architect
Architect
Sep 20, 2023 · Information Security

Understanding Same-Origin Policy and CORS in Web Development

This article explains the fundamentals of the Same‑Origin Policy, its security implications, and how Cross‑Origin Resource Sharing (CORS) works—including simple requests, preflight requests, and handling credentials—to help developers safely perform cross‑domain HTTP operations in browsers.

CORSCross-OriginHTTP
0 likes · 11 min read
Understanding Same-Origin Policy and CORS in Web Development
Huolala Tech
Huolala Tech
Sep 19, 2023 · Information Security

How to Detect and Block Malicious Bot Traffic Using Log Analysis

This guide explains how to identify and differentiate malicious bot traffic from legitimate requests by analyzing web server logs, leveraging fields such as IP, user‑agent, referer, and parameters, and then applying WAF rules, automation, and security platforms to mitigate attacks and improve operational metrics.

WAFWeb Securityautomation
0 likes · 31 min read
How to Detect and Block Malicious Bot Traffic Using Log Analysis
dbaplus Community
dbaplus Community
Sep 18, 2023 · Information Security

Why Chrome Is Moving to HTTPS‑First: What It Means for Web Security

Chrome’s latest experiment aims to automatically upgrade all HTTP requests to HTTPS, detailing current HTTPS adoption rates, the new HTTPS‑First mode’s automatic upgrades, unsafe download warnings, phased rollout plans, and how users can enable the feature now for a more secure browsing experience.

ChromeHTTPSHTTPS‑First
0 likes · 5 min read
Why Chrome Is Moving to HTTPS‑First: What It Means for Web Security
php Courses
php Courses
Sep 16, 2023 · Information Security

How to Use PHP htmlspecialchars() to Escape Special Characters and Prevent XSS

This article explains the purpose, syntax, optional parameters, and practical examples of PHP's htmlspecialchars() function, demonstrating how to safely convert special characters to HTML entities, control encoding and flags, avoid double‑encoding, and follow important usage considerations for secure web development.

PHPWeb SecurityXSS
0 likes · 6 min read
How to Use PHP htmlspecialchars() to Escape Special Characters and Prevent XSS
Selected Java Interview Questions
Selected Java Interview Questions
Sep 8, 2023 · Information Security

Understanding Same-Origin Policy and CORS in Web Development

This article explains the same‑origin policy, its security implications for DOM, web data and network communication, and how Cross‑Origin Resource Sharing (CORS) with simple and preflight requests enables controlled cross‑domain interactions while protecting users from attacks such as XSS, CSRF, and others.

CORSCross-OriginWeb Security
0 likes · 10 min read
Understanding Same-Origin Policy and CORS in Web Development
JavaEdge
JavaEdge
Aug 20, 2023 · Information Security

Cookie vs Authorization Header: Which Token Storage Method Is Safer?

This article compares storing authentication tokens in cookies versus the Authorization header, outlining each method's implementation, advantages, drawbacks, security implications such as XSS and CSRF risks, cross‑domain considerations, and compliance with authentication standards.

AuthenticationAuthorization HeaderToken Storage
0 likes · 5 min read
Cookie vs Authorization Header: Which Token Storage Method Is Safer?
Liangxu Linux
Liangxu Linux
Aug 19, 2023 · Information Security

Understanding CSRF Attacks: How They Work and How to Defend Against Them

This article explains the fundamentals of Cross‑Site Request Forgery (CSRF), describing its background, attack mechanics, key concepts, common prevention techniques such as anti‑CSRF tokens and SameSite cookies, and provides practical GET and POST examples to illustrate the threat.

Anti‑CSRF TokenCSRFCross-Site Request Forgery
0 likes · 9 min read
Understanding CSRF Attacks: How They Work and How to Defend Against Them
Sohu Tech Products
Sohu Tech Products
Aug 16, 2023 · Frontend Development

Accelerate JS Reverse Engineering with Sekiro RPC: A Step‑by‑Step Guide

This tutorial demonstrates how to bypass complex, layered encryption on a target website by using Sekiro RPC to invoke browser methods directly, covering analysis of the encrypted sign parameter, setting conditional breakpoints, overriding JavaScript files, defining a Sekiro client, and retrieving the signature via Python.

Browser debuggingJS reverse engineeringOverrides
0 likes · 9 min read
Accelerate JS Reverse Engineering with Sekiro RPC: A Step‑by‑Step Guide
IT Services Circle
IT Services Circle
Jul 25, 2023 · Information Security

Exploiting XSS Vulnerabilities and Same‑Origin Policy to Upgrade Risk Levels

This article explains how to combine reflected and stored cross‑site scripting attacks with same‑origin policy abuse to turn a low‑severity XSS vulnerability into a high‑severity issue, detailing discovery, exploitation steps, and a JavaScript payload that harvests user data.

Cross-site scriptingSame-Origin PolicyWeb Security
0 likes · 8 min read
Exploiting XSS Vulnerabilities and Same‑Origin Policy to Upgrade Risk Levels
macrozheng
macrozheng
Jul 22, 2023 · Fundamentals

Why Direct IP Access Fails: The Hidden Role of the Host Header in HTTPS

Although you can obtain a website’s IP address, accessing it directly via HTTPS often fails because the HTTP request’s Host header differs, and servers use this header to verify the intended domain, leading to 403 errors unless the correct Host value is supplied.

HTTPHTTPSWeb Security
0 likes · 5 min read
Why Direct IP Access Fails: The Hidden Role of the Host Header in HTTPS
php Courses
php Courses
Jul 5, 2023 · Information Security

Using PHP Security Library Functions to Prevent Code Injection Attacks

This article introduces PHP security library functions such as htmlspecialchars(), htmlentities(), and mysqli_real_escape_string(), demonstrating with code examples how they filter and validate user input to prevent XSS and SQL injection attacks, while noting that additional security measures are still required.

Input ValidationPHPSQL injection
0 likes · 4 min read
Using PHP Security Library Functions to Prevent Code Injection Attacks
php Courses
php Courses
Jun 11, 2023 · Information Security

Protecting Nginx with a ModSecurity Web Application Firewall (WAF)

This article explains why web applications need a Web Application Firewall, introduces ModSecurity as a WAF for Nginx, and provides step‑by‑step installation, configuration, custom rule creation, and service restart commands to defend against attacks such as SQL injection and XSS.

ModSecuritySQL injectionWAF
0 likes · 4 min read
Protecting Nginx with a ModSecurity Web Application Firewall (WAF)
Programmer DD
Programmer DD
Apr 13, 2023 · Backend Development

5 Proven Ways to Enable CORS in Java Backend Applications

This guide explains the browser's same‑origin policy, defines cross‑origin requests, outlines the restrictions on non‑same‑origin resources, and presents five Java‑backend techniques—including a global CorsFilter bean, WebMvcConfigurer, @CrossOrigin annotation, manual response headers, and a custom filter—to enable CORS.

CORSCross-OriginJava
0 likes · 8 min read
5 Proven Ways to Enable CORS in Java Backend Applications
vivo Internet Technology
vivo Internet Technology
Mar 8, 2023 · Information Security

Web Cache Poisoning and HTTP Request Smuggling: Principles, Attack Scenarios, and Defenses

The article explains how misconfigured caches and inconsistent front‑end/back‑end parsing enable web cache poisoning and HTTP request smuggling attacks, illustrates practical exploitation scenarios, and recommends disabling caching, unifying request‑boundary logic, and adopting HTTP/2 or strict configurations to defend against these high‑impact threats.

HTTP request smugglingRequest SmugglingVulnerability
0 likes · 16 min read
Web Cache Poisoning and HTTP Request Smuggling: Principles, Attack Scenarios, and Defenses
Open Source Linux
Open Source Linux
Mar 3, 2023 · Information Security

Why HTTP Is Insecure and How HTTPS Stops Man-in-the-Middle Attacks

This article explains the fundamental weaknesses of HTTP, demonstrates how man‑in‑the‑middle attacks exploit clear‑text communication, and shows how HTTPS—through SSL/TLS handshakes, certificate validation, and CA hierarchies—protects web traffic from interception and tampering.

HTTPHTTPSMan-in-the-Middle
0 likes · 9 min read
Why HTTP Is Insecure and How HTTPS Stops Man-in-the-Middle Attacks
Efficient Ops
Efficient Ops
Feb 8, 2023 · Information Security

Why Sessions Burden Servers and How Token‑Based Authentication Solves It

This article traces the evolution from simple web page browsing to modern token‑based authentication, explaining the scalability and security problems of server‑side sessions and showing how signed, stateless tokens using HMAC‑SHA256 eliminate those issues while supporting horizontal scaling and cross‑platform access.

HMACSession ManagementToken Authentication
0 likes · 13 min read
Why Sessions Burden Servers and How Token‑Based Authentication Solves It
php Courses
php Courses
Jan 29, 2023 · Information Security

SQL Injection Techniques, Exploits, and sqlmap Usage Guide

This article explains how forged HTTP headers can lead to SQL injection, demonstrates PHP functions for obtaining client IPs, shows blind injection payloads for enumerating databases, tables, columns, and users, and provides practical sqlmap commands and code examples for exploiting and testing vulnerabilities.

Database ExploitationSQL injectionSQLMap
0 likes · 15 min read
SQL Injection Techniques, Exploits, and sqlmap Usage Guide
Spring Full-Stack Practical Cases
Spring Full-Stack Practical Cases
Dec 12, 2022 · Backend Development

Mastering CORS in Spring MVC: Practical Configurations & Annotations

Spring MVC provides built‑in CORS support, allowing you to configure preflight, simple, and actual requests via global HandlerMapping settings, @CrossOrigin annotations, Java‑based CorsRegistry, or CorsFilter, with detailed options for origins, headers, methods, credentials, and max‑age to secure cross‑origin interactions.

CORSCross-OriginJava
0 likes · 8 min read
Mastering CORS in Spring MVC: Practical Configurations & Annotations
Architect
Architect
Oct 18, 2022 · Backend Development

Implementing CORS Cross‑Origin Requests in a Java Spring Backend

This article explains the browser same‑origin policy, defines cross‑origin requests, outlines the restrictions they impose, and presents five practical ways—global filter, WebMvcConfigurer, @CrossOrigin annotation, manual response headers, and a custom filter—to enable CORS in a Java Spring MVC backend with complete code examples.

BackendCORSJava
0 likes · 7 min read
Implementing CORS Cross‑Origin Requests in a Java Spring Backend
Java Architect Essentials
Java Architect Essentials
Sep 12, 2022 · Backend Development

Implementing CORS Cross‑Origin Requests in Java Backend (Spring Boot)

This article explains why browsers enforce the Same‑Origin Policy, defines cross‑origin requests, lists the restrictions of non‑same‑origin access, and provides five practical ways—global filter, WebMvcConfigurer, @CrossOrigin annotation, manual header setting, and a custom filter—to enable CORS in Java Spring Boot applications, complete with code examples.

CORSCross-OriginSpring Boot
0 likes · 9 min read
Implementing CORS Cross‑Origin Requests in Java Backend (Spring Boot)
Yunxuetang Frontend Team
Yunxuetang Frontend Team
Sep 9, 2022 · Frontend Development

Uncover 6 Weird React Behaviors and Fresh Frontend Trends

This curated overview highlights six puzzling React phenomena, introduces CSS Grid basics, examines AI‑generated art controversies, discusses COEP’s security benefits, reviews the new Fresh full‑stack framework, and explores how to measure user experience with data‑driven metrics.

AI artCSS GridReAct
0 likes · 4 min read
Uncover 6 Weird React Behaviors and Fresh Frontend Trends
Code Ape Tech Column
Code Ape Tech Column
Sep 6, 2022 · Information Security

Customizing Spring Security FormLogin Authentication

This tutorial demonstrates how to set up a Spring Security FormLogin authentication flow, including creating a demo project, customizing the login page, configuring security rules, defining users and roles, and testing the login process with custom success and failure handlers.

AuthenticationJavaSpring Boot
0 likes · 11 min read
Customizing Spring Security FormLogin Authentication
DaTaobao Tech
DaTaobao Tech
Aug 25, 2022 · Frontend Development

Understanding and Handling Script Error in Web Development

The article explains that browsers mask cross‑origin script failures as generic “Script error” due to the same‑origin policy, outlines the proper fix of adding the crossorigin attribute and Access‑Control‑Allow‑Origin header, critiques ad‑hoc proxy or try‑catch workarounds, and recommends systematic measures such as CSP Report‑Only, monitoring tools, and proper script whitelisting.

CSPCross-OriginFront-end debugging
0 likes · 7 min read
Understanding and Handling Script Error in Web Development
HomeTech
HomeTech
Aug 16, 2022 · Information Security

Understanding Chrome 94 Private Network Access Restrictions and CORS Errors

The article explains why browsers like Chrome 94 block cross‑origin requests from public contexts to private‑network resources, illustrates the issue with a reproducible example, analyzes the underlying policy changes, and provides practical solutions and configuration steps to mitigate the problem.

AJAXCORSChrome
0 likes · 6 min read
Understanding Chrome 94 Private Network Access Restrictions and CORS Errors
Programmer DD
Programmer DD
Aug 11, 2022 · Backend Development

Mastering CORS in Java: 5 Ways to Enable Cross-Origin Requests

This article explains why browsers enforce same‑origin policies, defines cross‑origin requests, outlines the restrictions on non‑same‑origin resources, and presents five practical Java backend solutions—including a global CorsFilter, WebMvcConfigurer, @CrossOrigin annotation, manual response headers, and a custom filter—complete with code examples.

CORSCross-OriginJava
0 likes · 7 min read
Mastering CORS in Java: 5 Ways to Enable Cross-Origin Requests
政采云技术
政采云技术
Aug 9, 2022 · Fundamentals

Understanding HTTP Referer: Definition, Policies, and Use Cases

HTTP Referer is a header field that indicates the source URL of the current webpage, playing a crucial role in web security, analytics, and troubleshooting, with various Referrer-Policy strategies controlling how much information is shared.

HTTP RefererHTTP headersReferrer-Policy
0 likes · 10 min read
Understanding HTTP Referer: Definition, Policies, and Use Cases
HomeTech
HomeTech
Aug 4, 2022 · Information Security

Preventing SQL Injection: Principles, Practices, and Safe MyBatis Usage

This article explains the fundamentals of SQL injection attacks, outlines their severe consequences, and provides a comprehensive set of prevention principles and practical measures—including parameterized queries, strong typing, input validation, and secure MyBatis configurations—to help developers safeguard backend applications and databases.

MyBatisPreparedStatementSQL injection
0 likes · 10 min read
Preventing SQL Injection: Principles, Practices, and Safe MyBatis Usage
MaGe Linux Operations
MaGe Linux Operations
May 21, 2022 · Information Security

Test Your Cybersecurity Knowledge with 10 Quick Quiz Questions

This article presents ten multiple‑choice questions covering symmetric and asymmetric encryption, web malware, cookie security, access control, ARP spoofing, malicious code detection, buffer overflows, SQL injection, and rainbow‑table defenses, letting readers assess their information‑security expertise.

QuizWeb Securitycryptography
0 likes · 6 min read
Test Your Cybersecurity Knowledge with 10 Quick Quiz Questions
Selected Java Interview Questions
Selected Java Interview Questions
May 16, 2022 · Backend Development

Implementing CORS Cross-Origin Requests in Java Backend

This article explains the origin of CORS issues caused by the browser's Same‑Origin Policy, describes what constitutes a cross‑origin request, outlines the restrictions of non‑same‑origin resources, and provides five Java‑based solutions—including a global CorsFilter bean, WebMvcConfigurer override, @CrossOrigin annotation, manual response‑header setting, and a custom filter—to enable cross‑origin access.

CORSCross-OriginSpringBoot
0 likes · 7 min read
Implementing CORS Cross-Origin Requests in Java Backend
DaTaobao Tech
DaTaobao Tech
May 10, 2022 · Information Security

Web Security Sandbox Using WebAssembly and QuickJS

This paper proposes a WebAssembly‑QuickJS sandbox that isolates JavaScript execution and uses Shadow DOM/iframe for CSS isolation, delivering W3C‑compliant, high‑performance security for web apps, achieving 355× communication gains over mini‑programs while maintaining a lightweight, extensible ecosystem for e‑commerce plugins.

Container ArchitectureOpen TechnologyQuickJS
0 likes · 5 min read
Web Security Sandbox Using WebAssembly and QuickJS
ELab Team
ELab Team
Apr 29, 2022 · Information Security

Why HTTPS Is Essential: A Deep Dive into HTTP, Encryption, and SSL/TLS

This article explains the evolution from HTTP to HTTPS, detailing HTTP’s history, its security shortcomings, the principles of symmetric and asymmetric encryption, digital signatures, certificate authorities, and the complete HTTPS handshake process, helping readers understand how secure web communication works.

HTTPSTLSWeb Security
0 likes · 16 min read
Why HTTPS Is Essential: A Deep Dive into HTTP, Encryption, and SSL/TLS
Laravel Tech Community
Laravel Tech Community
Apr 28, 2022 · Information Security

Understanding OS Command Injection in PHP and How to Prevent It

The article explains how PHP functions like exec(), system(), passthru(), popen(), backtick operator, shell_exec() and pcntl_exec() can be abused for OS command injection, demonstrates vulnerable code examples, and provides practical mitigation techniques to secure web applications.

OS command injectionPHPWeb Security
0 likes · 6 min read
Understanding OS Command Injection in PHP and How to Prevent It
Practical DevOps Architecture
Practical DevOps Architecture
Apr 14, 2022 · Backend Development

Understanding and Solving Cross-Origin Issues with Nginx add_header Configuration

This article explains when cross‑origin problems occur due to the browser's same‑origin policy, describes the restrictions it imposes, and provides detailed Nginx add_header configurations—including specific and global examples—to enable Access‑Control‑Allow‑Origin and Access‑Control‑Allow‑Methods headers for CORS resolution.

CORSCross-OriginHTTP headers
0 likes · 4 min read
Understanding and Solving Cross-Origin Issues with Nginx add_header Configuration
Laravel Tech Community
Laravel Tech Community
Apr 5, 2022 · Information Security

Preventing XSS Attacks in PHP: Best Practices and Code Examples

This article explains various methods to prevent XSS injection in PHP, covering the limitations of built‑in filters, proper use of htmlspecialchars and htmlentities, replacement techniques, and provides comprehensive PHP functions with code examples for sanitizing user input and removing malicious scripts.

Code ExamplePHPWeb Security
0 likes · 7 min read
Preventing XSS Attacks in PHP: Best Practices and Code Examples
Architect's Guide
Architect's Guide
Mar 27, 2022 · Information Security

Understanding JSON Web Tokens (JWT): Structure, Creation, and Practical Use

This article explains the lightweight JWT specification, walks through its three-part structure (header, payload, signature), shows how to encode and sign a token with Node.js, and demonstrates using a JWT‑based link to perform a friend‑request operation without requiring the recipient to log in.

AuthenticationBase64JWT
0 likes · 8 min read
Understanding JSON Web Tokens (JWT): Structure, Creation, and Practical Use
YunZhu Net Technology Team
YunZhu Net Technology Team
Mar 24, 2022 · Information Security

Understanding XSS, CSRF, and Clickjacking: Attack Mechanisms and Defense Measures

This article explains the principles, attack vectors, and mitigation techniques for three common web security threats—Cross‑Site Scripting (XSS), Cross‑Site Request Forgery (CSRF), and Clickjacking—detailing how malicious scripts are injected, how forged requests exploit user credentials, and how defensive headers, token strategies, and frame restrictions can protect applications.

CSRFContent Security PolicySameSite
0 likes · 14 min read
Understanding XSS, CSRF, and Clickjacking: Attack Mechanisms and Defense Measures
Su San Talks Tech
Su San Talks Tech
Mar 8, 2022 · Information Security

Cookie vs Session vs JWT: Choosing the Right Authentication Strategy

This article compares cookies, server-side sessions, and JWT tokens, explaining their mechanisms, advantages, drawbacks, and best-use scenarios for web authentication, load‑balanced environments, and mobile applications, while also addressing security concerns such as CSRF and token storage.

CookieSessionToken
0 likes · 15 min read
Cookie vs Session vs JWT: Choosing the Right Authentication Strategy
Top Architect
Top Architect
Mar 8, 2022 · Information Security

Understanding OAuth2.0: Principles, Architecture, and Implementation

This article explains the fundamentals of OAuth2.0, distinguishes it from SSO, describes the three main participants, outlines the complete authorization flow with step‑by‑step details, defines key terminology, and discusses deployment scenarios such as web servers, user‑agent apps, and native applications.

APIAuthenticationAuthorization
0 likes · 11 min read
Understanding OAuth2.0: Principles, Architecture, and Implementation
Architecture and Beyond
Architecture and Beyond
Jan 17, 2022 · Information Security

Understanding Web Session Management: Concepts, Storage Strategies, and Token‑Based Authentication

This article explains the fundamentals of web session management, compares server‑side, cookie‑based, and token‑based storage methods, discusses authentication versus authorization, and outlines security considerations and best‑practice recommendations for managing user sessions in modern web applications.

AuthorizationBackendCookie
0 likes · 11 min read
Understanding Web Session Management: Concepts, Storage Strategies, and Token‑Based Authentication
Alibaba Cloud Native
Alibaba Cloud Native
Jan 15, 2022 · Cloud Native

How to Secure Your Web Services with AHAS: Fine‑Grained Traffic Protection in Cloud‑Native Environments

This guide explains how to use Alibaba Cloud's Application High Availability Service (AHAS) with Sentinel to implement fine‑grained traffic control, hotspot detection, concurrency limits, circuit breaking, and fallback handling for Java and Go web applications, illustrated with a Spring Boot example.

AHASSentinelSpring Boot
0 likes · 9 min read
How to Secure Your Web Services with AHAS: Fine‑Grained Traffic Protection in Cloud‑Native Environments
Programmer DD
Programmer DD
Jan 14, 2022 · Information Security

Exploiting HTTP Host Header: From Password Reset Poisoning to SSRF

This article explains the purpose of the HTTP Host header, how Host header attacks work, methods to discover and exploit them—including password‑reset poisoning, cache poisoning, access‑control bypass, and SSRF—and provides practical mitigation techniques for developers and security teams.

HTTP Host headerSSRFWeb Security
0 likes · 20 min read
Exploiting HTTP Host Header: From Password Reset Poisoning to SSRF
WeDoctor Frontend Technology
WeDoctor Frontend Technology
Jan 12, 2022 · Frontend Development

Unpacking Cookies: From Basics to Future Front‑End Management

This article explores HTTP cookies in depth, covering their definition, attributes, security settings, tracking mechanisms, third‑party usage, front‑end management practices, emerging standards like SameSite and SameParty, and future trends such as Chrome’s privacy sandbox and the Cookie Store API.

Web Securitycookiesfrontend
0 likes · 26 min read
Unpacking Cookies: From Basics to Future Front‑End Management
TAL Education Technology
TAL Education Technology
Jan 6, 2022 · Information Security

Web Security Essentials for Front-End Engineers

This article educates front‑end engineers about common web security threats such as XSS, CSRF, directory exposure, SQL injection, command injection, DDoS, and hijacking, and provides practical mitigation techniques and best‑practice principles to build more secure web applications.

Best PracticesCSRFSQL injection
0 likes · 12 min read
Web Security Essentials for Front-End Engineers
政采云技术
政采云技术
Dec 30, 2021 · Information Security

Introduction to Web Security Testing and Common Vulnerabilities

This article introduces web security testing, explains why it is essential, describes common vulnerabilities such as weak passwords, XSS, CSRF, SQL injection, authorization bypass, and file upload issues, and offers practical prevention measures and testing guidelines for developers and testers.

SQL injectionSecurity TestingVulnerability
0 likes · 14 min read
Introduction to Web Security Testing and Common Vulnerabilities
Java Architect Essentials
Java Architect Essentials
Dec 15, 2021 · Information Security

Mastering Single Sign‑On: Principles, Architecture, and Java Implementation

This article explains the fundamentals of HTTP's stateless nature, session handling in single‑system web apps, the challenges of multi‑system environments, and presents a detailed walkthrough of Single Sign‑On concepts, token‑based authentication flow, global versus local sessions, deployment considerations, and a step‑by‑step Java implementation with code examples.

AuthenticationJavaSSO
0 likes · 17 min read
Mastering Single Sign‑On: Principles, Architecture, and Java Implementation
Programmer DD
Programmer DD
Nov 8, 2021 · Frontend Development

Mastering Cross-Origin: From JSONP to CORS and Beyond

This article explains the browser's same‑origin policy, why cross‑origin requests are blocked, and walks through practical solutions—including JSONP, CORS with simple and preflight requests, PostMessage, WebSocket, Nginx reverse proxy, Node middleware proxy, and document.domain—so developers can choose the right technique for their needs.

CORSCross-OriginJSONP
0 likes · 16 min read
Mastering Cross-Origin: From JSONP to CORS and Beyond
Taobao Frontend Technology
Taobao Frontend Technology
Oct 18, 2021 · Frontend Development

Top Front‑End Releases: AppWorks 1.5, Parcel 2, Superplate, DOM Treemap & Sanitizer API

This roundup highlights recent front‑end open‑source updates, including AppWorks 1.5’s auto‑style imports, Parcel 2’s plugin system and Rust‑based performance boost, the Superplate starter kit, the DOM Treemap DevTools extension, Theatre.js animation library, and the W3C Sanitizer API proposal for preventing XSS attacks.

Web Securityopen-sourcetooling
0 likes · 5 min read
Top Front‑End Releases: AppWorks 1.5, Parcel 2, Superplate, DOM Treemap & Sanitizer API
MaGe Linux Operations
MaGe Linux Operations
Sep 25, 2021 · Information Security

How to Build a Docker‑Based Kali Linux Lab with Web Target for Pen‑Testing

This guide walks you through creating a Docker‑powered environment that includes a graphical Kali Linux workstation and a web target machine with MySQL and Tomcat, covering Docker installation, image preparation, container configuration, remote desktop setup, and database integration for hands‑on information‑security practice.

ContainerizationDockerKali Linux
0 likes · 8 min read
How to Build a Docker‑Based Kali Linux Lab with Web Target for Pen‑Testing
Laravel Tech Community
Laravel Tech Community
Sep 11, 2021 · Information Security

Understanding SQL Injection Vulnerabilities in PHP and How to Prevent Them

This article explains the causes, impacts, and various techniques of SQL injection attacks in PHP applications, demonstrates vulnerable code examples, and provides practical mitigation measures such as input validation, error handling, character encoding considerations, and secure coding practices.

PHPSQL injectionVulnerability
0 likes · 10 min read
Understanding SQL Injection Vulnerabilities in PHP and How to Prevent Them
IT Architects Alliance
IT Architects Alliance
Aug 25, 2021 · Information Security

Understanding Single Sign-On (SSO) Mechanism and Java Implementation

This article explains the stateless nature of HTTP, the session and cookie mechanisms for single‑system login, the challenges of multi‑system environments, and provides a detailed overview of Single Sign‑On (SSO) concepts, token flow, and step‑by‑step Java code examples for client and server implementations.

AuthenticationJavaSSO
0 likes · 14 min read
Understanding Single Sign-On (SSO) Mechanism and Java Implementation
21CTO
21CTO
Aug 25, 2021 · Information Security

Why Simple Web Login Is Vulnerable and How to Secure It with Encryption and Tokens

This article examines common security flaws in basic web login forms, demonstrates how plain‑text passwords can be intercepted, and presents practical countermeasures such as client‑side encryption, hashing, captchas, tokens, and digital signatures to protect credentials and data integrity.

CAPTCHALogin AuthenticationMD5
0 likes · 13 min read
Why Simple Web Login Is Vulnerable and How to Secure It with Encryption and Tokens
Top Architect
Top Architect
Aug 23, 2021 · Information Security

Security Considerations for Web Login: From Plain HTTP to Encryption, Tokens, and Digital Signatures

This article examines common security vulnerabilities in web login processes, illustrating how plain HTTP exposes credentials, evaluating symmetric and asymmetric encryption, token-based authentication, and digital signatures, and proposes layered protection strategies such as MD5 hashing, CAPTCHA, and token mechanisms to safeguard user data.

MD5TokenWeb Security
0 likes · 12 min read
Security Considerations for Web Login: From Plain HTTP to Encryption, Tokens, and Digital Signatures
DataFunTalk
DataFunTalk
Aug 21, 2021 · Information Security

CAPTCHA: History, Development, and Its Role in Cybersecurity and Anti‑Fraud Strategies

This article reviews the origin and evolution of CAPTCHAs, examines early applications and OCR attacks, describes the three generations of reCAPTCHA and emerging verification methods, and discusses how CAPTCHAs are used to raise attack barriers, filter malicious traffic, and support risk assessment in modern anti‑fraud systems.

AICAPTCHASecurity
0 likes · 13 min read
CAPTCHA: History, Development, and Its Role in Cybersecurity and Anti‑Fraud Strategies
Programmer DD
Programmer DD
Aug 19, 2021 · Backend Development

Integrate WeChat OAuth2 with Spring Security for Secure Web Apps

This guide walks through setting up WeChat web authorization, customizing Spring Security's OAuth2 flow, handling token exchange, and retrieving user info, providing a complete backend solution for secure WeChat-enabled applications.

JavaOAuth2Spring Boot
0 likes · 16 min read
Integrate WeChat OAuth2 with Spring Security for Secure Web Apps
Selected Java Interview Questions
Selected Java Interview Questions
Aug 15, 2021 · Information Security

Understanding Web Login Security: Risks, Encryption Methods, Tokens, and Digital Signatures

This article examines common security vulnerabilities in web login processes, demonstrates how plain‑text passwords can be intercepted over HTTP/HTTPS, evaluates symmetric and asymmetric encryption, discusses the limitations of MD5, and proposes token‑based and digital‑signature solutions to protect credentials and data integrity.

AuthenticationHTTPSMD5
0 likes · 14 min read
Understanding Web Login Security: Risks, Encryption Methods, Tokens, and Digital Signatures
ByteFE
ByteFE
Aug 11, 2021 · Information Security

Understanding Browser Incognito Mode: Limitations, Detection Techniques, and Fingerprinting

The article explains how browser incognito or private‑browsing modes work, clarifies common misconceptions, details why they do not provide true anonymity, and explores technical detection methods and fingerprinting techniques—including code examples—while offering guidance on protecting personal privacy.

Browser FingerprintingWeb Securityincognito
0 likes · 26 min read
Understanding Browser Incognito Mode: Limitations, Detection Techniques, and Fingerprinting
Code Ape Tech Column
Code Ape Tech Column
Jul 12, 2021 · Information Security

MyBatis SQL Injection Auditing: Common Vulnerabilities and Practical Analysis

This article explains how SQL injection can still occur in Java applications using MyBatis, describes the three typical vulnerable patterns (LIKE, IN, ORDER BY), and provides a step‑by‑step practical workflow—including code snippets and verification—to help beginners audit and remediate such issues.

Code AuditingJavaMyBatis
0 likes · 7 min read
MyBatis SQL Injection Auditing: Common Vulnerabilities and Practical Analysis
Python Programming Learning Circle
Python Programming Learning Circle
Jun 26, 2021 · Information Security

Security Analysis and Exploitation of a QQ Phishing Website

The article documents a step‑by‑step security investigation of a QQ phishing site, detailing its fake login page, POST endpoint, Python‑based credential flooding, network reconnaissance, port scanning, vulnerability scanning, and discovery of the backend control panel, while discussing the challenges of XSS and brute‑force attacks.

Web Securityinformation securitynetwork scanning
0 likes · 7 min read
Security Analysis and Exploitation of a QQ Phishing Website
macrozheng
macrozheng
May 31, 2021 · Information Security

Cookie vs Session vs JWT: When to Use Each for Secure Authentication

This article compares the mechanisms of Cookie, Session, and JWT token for user authentication, explaining their histories, workflows, scalability challenges, security trade‑offs, and best‑practice scenarios such as single sign‑on, mobile access, and CSRF protection.

CookieSessionToken
0 likes · 16 min read
Cookie vs Session vs JWT: When to Use Each for Secure Authentication