This article recounts Stack Overflow’s multi‑year migration to HTTPS, detailing technical hurdles such as handling hundreds of domains, certificate management, HTTP/2 performance, HAProxy configuration, CDN integration, and the operational practices that ensured a secure and high‑performance global platform.
This article explains the fundamental risks of plain HTTP, introduces HTTPS as a solution, and walks through the concepts of asymmetric encryption, digital signatures, certificate authorities, and the TLS handshake process using a relatable story of Bob and his friends to illustrate secure communication.
This article explains the fundamentals of the browser same‑origin policy, defines what constitutes an origin, describes the restrictions it imposes, and surveys practical cross‑origin solutions such as dynamic tags, JSONP, CORS, postMessage, document.domain, window.name, fetch, and WebSocket.
This article recounts the development of Ctrip's graphical captcha system, describing its early .NET‑based implementation, the challenges encountered such as uniform difficulty, limited data collection, and poor user experience, and how successive redesigns—including multilingual support, adaptive difficulty, and slider‑plus‑character selection—balanced security and usability.
This article explains the concept and architecture of an unmanned customer service system, outlines its security testing strategy—including interface, vulnerability scanning, privilege and data protection tests—describes database and web security methods, and provides practical command examples and tool recommendations.
The article reexamines web security as a holistic system, explaining attack goals, targets, and methods across browsers, transport channels, and servers, and shows how coordinated front‑end and back‑end defenses such as encryption, signing, and input validation are essential to protect the whole web stack.
The schedule outlines a five‑day series of backend‑focused sessions covering SOA architecture, DSF database integration, distributed system fundamentals, web security programming, and hands‑on MVC project development for a tourism hotel order system, culminating in assessment review and graduation preparation.
This article compiles 42 practical questions and answers covering information gathering, vulnerability identification, exploitation tactics, and remediation advice for web applications, databases, servers, and common security mechanisms, providing a concise reference for penetration testers and security engineers.
This article explains why SQL injection occurs in Python web development, demonstrates vulnerable code using string concatenation, shows the resulting errors, and provides two effective solutions—input escaping and MySQLdb's parameterized queries—to secure your applications.
The article examines the high‑risk CVE‑2017‑5638 vulnerability in Apache Struts2, detailing its remote code execution mechanism, global impact statistics across industries and regions, and provides comprehensive detection methods and three tiers of remediation solutions.
This article explains the concept of communication protocols, defines HTTP and its security shortcomings, introduces HTTPS with its encryption mechanisms, compares their performance and cost implications, and clarifies common misconceptions, helping developers understand why HTTPS is essential for modern web applications.
This article explains the mechanics of SQL injection and XSS attacks, demonstrates common exploitation methods such as table‑name guessing, error‑based and union queries, shows a vulnerable authentication script, and provides practical defensive coding techniques to mitigate these threats.
This article provides a practical introduction to SQL injection, covering its fundamentals, common attack vectors such as Boolean‑based, error‑based, and UNION‑based injections, step‑by‑step exploitation examples with PHP code, and tips for constructing payloads and understanding their impact on vulnerable web applications.
The article reviews the author’s experience with security testing, explains the severe risks of SQL injection, demonstrates vulnerable server‑side code, and provides practical remediation methods such as input sanitization, type casting, and using prepared statements with PDO.
This article describes Ctrip's challenges with web security, evaluates hardware and commercial cloud WAF shortcomings, and presents a low‑cost, low‑risk cloud‑based WAF solution that leverages DNS redirection, closed‑loop rule management, Lua/Tengine deployment, supervised machine‑learning log analysis, and big‑data streaming for real‑time threat detection and mitigation.
This guide explains the most important HTTP response security headers—such as X‑Frame‑Options, X‑Content‑Type‑Options, X‑XSS‑Protection, Content‑Security‑Policy, Strict‑Transport‑Security, and CORS headers—detailing their purpose, possible values, and how to configure them in Apache to harden web applications.
This article compares JSON Web Tokens and session cookies, highlighting JWT’s superior stability, security, RESTful compatibility, and performance, and explains the scenarios where JWT is the preferred choice for modern web applications.
This article explains why migrating to HTTPS is critical for modern web applications, outlines the technical challenges such as compatibility, latency, and attacks, and details Baidu's practical solutions and free options for small sites to adopt full‑site HTTPS securely and efficiently.
This article shares practical anti‑crawling concepts, classifications of crawlers, design principles, traditional and JavaScript‑based countermeasures, and operational trade‑offs, illustrating how Ctrip's hotel R&D team balances commercial protection with technical feasibility.
This article explains why MongoDB is chosen, demonstrates practical PHP injection techniques against MongoDB queries, shows how to enumerate databases and collections, and provides concrete defensive measures such as using implode(), addslashes() and regex sanitization to prevent attacks.
This guide walks you through obtaining a free Let’s Encrypt certificate, installing it on typical hosting platforms, fixing common private‑key issues, verifying the setup, and enforcing HTTPS for all requests, all in under half an hour.
This guide explains how to use simple Nginx configurations, enhanced cookie checks, and Lua scripts to create unforgeable tokens, limit request rates, and protect web services from CC attacks, scanning tools, and other malicious traffic while maintaining normal user access.
The article examines how HTTP header and cookie parameters can serve as SQL injection vectors, evaluates the coverage of commercial and open‑source web vulnerability scanners, demonstrates manual testing techniques, and recommends tools such as sqlmap for comprehensive security assessments.
The article uses a warehouse‑robot analogy to illustrate how mixing user‑supplied data with commands leads to SQL injection and explains that separating commands from data via parameterized queries prevents this security flaw.
This article explains HTTPS fundamentals, its encryption mechanisms, differences from HTTP, the roles of symmetric and asymmetric cryptography, hash functions, digital signatures, certificate issuance and validation, as well as SSL/TLS protocols, handshake steps, and session resumption techniques that secure web communications.
This article surveys seven modern hacking tricks—from fake Wi‑Fi hotspots and cookie theft to file‑name deception, path hijacking, hosts‑file redirection, watering‑hole attacks, and bait‑replacement—explaining how they work, why they succeed, and practical defenses for users and developers.
This guide outlines a comprehensive security checklist covering form input validation, safe system call handling, buffer overflow prevention, strong password policies, session protection, mitigation of XSS, SQL injection, CSRF, Apache and MySQL hardening, PHP configuration, and fuzz testing techniques.
CC attacks, a variant of DDoS that exploits legitimate web requests via proxies, overwhelm servers by forcing intensive URL processing; this article explains their mechanics, differences from traditional DDoS, and outlines practical defenses such as cloud WAFs, IP analysis, static content, and connection‑rate limiting.
This article walks you through designing, installing, and configuring a custom WAF using Nginx and Lua (OpenResty), covering core modules, pain points of native Nginx security, code examples, deployment tips, and future enhancements for robust web protection.
The article presents a comprehensive list of one hundred concrete web‑application security techniques—ranging from HTTP request analysis and token validation to WAF rule conversion, honeypot deployment, IP reputation checks, and response‑time monitoring—derived from the book “Web Application Defender's Cookbook” and illustrated with real‑world examples and tool references.
The article presents a comprehensive list of one hundred practical web‑application defense techniques—ranging from HTTP request analysis and ModSecurity rule creation to honeypot deployment and automated threat intelligence—drawn from the under‑appreciated book “Web Application Defender’s Cookbook.”
This article explains how HTTPS certificates are trusted, the role of Certificate Authorities, how browsers verify signatures, common pitfalls such as compromised root certificates, and practical measures like CSP and gradual rollout strategies to ensure secure web deployments across different regions and devices.
Content Security Policy (CSP) is a browser‑level defense that defines a whitelist of trusted sources for scripts, styles, images, and other resources, preventing malicious code injection such as XSS by blocking any content not explicitly allowed.
The article explains how modern web and cloud‑based applications are increasingly exposed to a range of application‑layer attacks—including injection, XSS, broken authentication, and insecure redirects—while highlighting OWASP’s Top 10 list, the importance of secure development practices, and IBM’s educational webinar series.
The article outlines five subtle indicators of a web application breach—abnormal behavior, irregular logs, unexpected processes or users, file modifications, and warning messages—while offering practical monitoring and remediation steps to help security teams detect and mitigate attacks early.
File upload vulnerabilities are common and severe, allowing attackers to execute scripts, deploy malicious files, or launch phishing attacks, but proper filtering and isolating upload directories without execution rights can effectively mitigate these risks.
This article explains why JSONP is limited to GET requests, demonstrates a Baidu API call that works via CORS, and shows how to enable CORS on the server with the Access-Control-Allow-Origin header for all or specific origins.
This article explains how CSRF (Cross‑site request forgery) tricks authenticated users into performing attacker‑controlled actions, illustrates a typical admin‑addition scenario, and outlines two primary defenses—CAPTCHA verification and dynamic token validation—to effectively mitigate such attacks.
This article explains the many data points browsers expose—such as IP, cookies, language, hardware, and HTML5 APIs—that enable device fingerprinting, describes how fingerprinting scripts operate, and outlines practical countermeasures like disabling JavaScript, using privacy extensions, and configuring browser settings.
This article outlines the most common web application security threats—including XSS, SQL injection, CSRF, transmission hijacking, credential leaks, brute‑force attacks, and token theft—and provides practical mitigation techniques such as proper escaping, CSP, parameterized queries, CSRF tokens, HTTPS, HSTS, HPKP, encrypted password storage, two‑factor authentication, and robust token handling.
This article explains common web security threats such as XSS and CSRF in a front‑end/back‑end separated architecture and demonstrates how the Midway framework provides HTML escaping, rich‑text filtering, and token‑based CSRF protection to safeguard user data and application integrity.
This article examines how web vulnerability scanners handle non‑traditional input vectors such as HTTP headers and cookies, demonstrates manual exploitation techniques for header‑based SQL injection, compares scanner coverage and accuracy, and offers practical guidance for developers and penetration testers.
The article explains how malicious JavaScript can turn browsers into participants of DDoS attacks through techniques like server hijacking and man‑in‑the‑middle injection, and describes how HTTPS and the emerging Subresource Integrity feature can help protect websites from such threats.
The article explains how malicious JavaScript can be used to launch DDoS attacks through image flooding, server hijacking, and man‑in‑the‑middle injection, and describes mitigation techniques such as HTTPS, Subresource Integrity, and other security measures.
This article explains the HTTPS protocol, covering its combination of HTTP and TLS, the roles of symmetric and asymmetric encryption, key exchange methods like RSA and ECDHE, certificate-based authentication, data integrity checks, and practical considerations such as performance impact and deployment costs.
The article outlines front‑end web security tactics—blocking all user‑supplied external links, sanitizing rich‑text to prevent XSS and iframe abuse, nullifying window.opener to stop phishing redirects—while recommending CSP, whitelist CSS, sandboxed iframes, and click‑through confirmations as mitigations.
Web traffic hijacking exploits the plaintext nature of HTTP to inject malicious scripts, steal cookies and saved passwords, poison caches or offline storage, bypass HTTPS redirects, and even compromise downloads, making unauthenticated browsing, auto‑fill features, and public Wi‑Fi especially dangerous without proper defenses.
