⤷ Title: How “just forward the request” turns into a surprisingly complicated job
════════════════════════
𐀪 Author: Gaurirai
════════════════════════
ⴵ Time: Wed, 12 Aug 2026 09:57:24 GMT
════════════════════════
⌗ Tags: #jwt_authentication #reverse_proxy #api_security #ruby_on_rails #api_gateway
════════════════════════
𐀪 Author: Gaurirai
════════════════════════
ⴵ Time: Wed, 12 Aug 2026 09:57:24 GMT
════════════════════════
⌗ Tags: #jwt_authentication #reverse_proxy #api_security #ruby_on_rails #api_gateway
Medium
How “just forward the request” turns into a surprisingly complicated job
You send a request: Get /orders Authorization: Bearer eyfghj…..
⤷ Title: Lab Write-up: Information Disclosure on Debug Page
════════════════════════
𐀪 Author: Ayeshaaghafoor
════════════════════════
ⴵ Time: Wed, 12 Aug 2026 13:42:50 GMT
════════════════════════
⌗ Tags: #penetration_testing #cybersecurity_awareness #bug_bounty #api #cybersecurity
════════════════════════
𐀪 Author: Ayeshaaghafoor
════════════════════════
ⴵ Time: Wed, 12 Aug 2026 13:42:50 GMT
════════════════════════
⌗ Tags: #penetration_testing #cybersecurity_awareness #bug_bounty #api #cybersecurity
Medium
Lab Write-up: Information Disclosure on Debug Page
Objective
⤷ Title: The OWASP API Top 10, Translated Into Bugs You’ve Actually Written
════════════════════════
𐀪 Author: Daniel Valev
════════════════════════
ⴵ Time: Wed, 12 Aug 2026 12:31:01 GMT
════════════════════════
⌗ Tags: #programming #api_security #software_engineering #fastapi #application_security
════════════════════════
𐀪 Author: Daniel Valev
════════════════════════
ⴵ Time: Wed, 12 Aug 2026 12:31:01 GMT
════════════════════════
⌗ Tags: #programming #api_security #software_engineering #fastapi #application_security
Medium
The OWASP API Top 10, Translated Into Bugs You’ve Actually Written
Your ORM will happily hand an attacker another customer’s row. It’s doing exactly what you asked.
⤷ Title: Lab Write-up: Information Disclosure in Error Messages
════════════════════════
𐀪 Author: Ayeshaaghafoor
════════════════════════
ⴵ Time: Wed, 12 Aug 2026 13:40:52 GMT
════════════════════════
⌗ Tags: #cybersecurity_awareness #api #penetration_testing #web_development #cybersecurity
════════════════════════
𐀪 Author: Ayeshaaghafoor
════════════════════════
ⴵ Time: Wed, 12 Aug 2026 13:40:52 GMT
════════════════════════
⌗ Tags: #cybersecurity_awareness #api #penetration_testing #web_development #cybersecurity
Medium
Lab Write-up: Information Disclosure in Error Messages
Objective
⤷ Title: How Unauthenticated Queries Exposed User PII and Privileged Accounts
════════════════════════
𐀪 Author: Sudheer
════════════════════════
ⴵ Time: Thu, 13 Aug 2026 07:26:04 GMT
════════════════════════
⌗ Tags: #authorization #api_security #bug_bounty #authentication #web_security_testing
════════════════════════
𐀪 Author: Sudheer
════════════════════════
ⴵ Time: Thu, 13 Aug 2026 07:26:04 GMT
════════════════════════
⌗ Tags: #authorization #api_security #bug_bounty #authentication #web_security_testing
Medium
How Unauthenticated Queries Exposed User PII and Privileged Accounts
Unauthenticated API queries exposed sensitive user data and enabled enumeration of the application’s entire observed userbase.
⤷ Title: Hunting IDOR & BOLA in REST APIs: A Practical Authorization Testing Methodology
════════════════════════
𐀪 Author: Ishant
════════════════════════
ⴵ Time: Thu, 13 Aug 2026 11:08:37 GMT
════════════════════════
⌗ Tags: #web_security #cybersecurity #api_security
════════════════════════
𐀪 Author: Ishant
════════════════════════
ⴵ Time: Thu, 13 Aug 2026 11:08:37 GMT
════════════════════════
⌗ Tags: #web_security #cybersecurity #api_security
Medium
Hunting IDOR & BOLA in REST APIs: A Practical Authorization Testing Methodology
A method for detecting broken authorization in REST APIs is shown using the OWASP crAPI.
⤷ Title: 5 min read
════════════════════════
𐀪 Author: Rhuber
════════════════════════
ⴵ Time: Thu, 13 Aug 2026 16:45:33 GMT
════════════════════════
⌗ Tags: #api #api_security #devportal #api_portal
════════════════════════
𐀪 Author: Rhuber
════════════════════════
ⴵ Time: Thu, 13 Aug 2026 16:45:33 GMT
════════════════════════
⌗ Tags: #api #api_security #devportal #api_portal
Medium
5 min read
Your API Portal’s Biggest Threat Isn’t Hackers — It’s Visibility Without Control
⤷ Title: Your API Portal’s Biggest Threat Isn’t Hackers — It’s Visibility Without Control
════════════════════════
𐀪 Author: Rhuber
════════════════════════
ⴵ Time: Thu, 13 Aug 2026 16:45:33 GMT
════════════════════════
⌗ Tags: #api #api_security #devportal #api_portal
════════════════════════
𐀪 Author: Rhuber
════════════════════════
ⴵ Time: Thu, 13 Aug 2026 16:45:33 GMT
════════════════════════
⌗ Tags: #api #api_security #devportal #api_portal
Medium
5 min read
Your API Portal’s Biggest Threat Isn’t Hackers — It’s Visibility Without Control
⤷ Title: How Would You Prevent Unauthorized Users From Accessing Other Users’ Data?
════════════════════════
𐀪 Author: Gokulapriyan
════════════════════════
ⴵ Time: Fri, 14 Aug 2026 02:19:19 GMT
════════════════════════
⌗ Tags: #security #api_security #prevention #unauthorized_access #rest_api_security
════════════════════════
𐀪 Author: Gokulapriyan
════════════════════════
ⴵ Time: Fri, 14 Aug 2026 02:19:19 GMT
════════════════════════
⌗ Tags: #security #api_security #prevention #unauthorized_access #rest_api_security
Medium
How Would You Prevent Unauthorized Users From Accessing Other Users’ Data?
One of the most important responsibilities of a backend application is protecting user data.
⤷ Title: Beyond OAuth Scopes: Fine-Grained Authorization with RAR in WSO2 Identity Server
════════════════════════
𐀪 Author: Sanjula Herath
════════════════════════
ⴵ Time: Fri, 14 Aug 2026 07:36:38 GMT
════════════════════════
⌗ Tags: #oauth2 #wso2 #api_security #identity_and_access #open_banking
════════════════════════
𐀪 Author: Sanjula Herath
════════════════════════
ⴵ Time: Fri, 14 Aug 2026 07:36:38 GMT
════════════════════════
⌗ Tags: #oauth2 #wso2 #api_security #identity_and_access #open_banking
Medium
Beyond OAuth Scopes: Fine-Grained Authorization with RAR in WSO2 Identity Server
Build an OAuth flow that authorizes a specific action, amount, recipient, and API — not an ambiguous category of access.