This feed provides in-depth and nuanced articles on software security and secure application development. The articles provide concrete guidelines and address common questions and misconceptions on building secure applications. https://pragmaticwebsecurity.com/articles.html Mon, 08 Sep 2025 16:34:54 +0000 Tue, 24 May 2022 00:00:00 +0000 en https://pragmaticwebsecurity.com/icons/favicon-32x32.png https://pragmaticwebsecurity.com/pws_logo_rss.png https://pragmaticwebsecurity.com/pws_logo_rss.png https://pragmaticwebsecurity.com/articles.html 100 100 This feed provides in-depth and nuanced articles on software security and secure application development. The articles provide concrete guidelines and address common questions and misconceptions on building secure applications. CSP is one of the most elaborate security policies in modern browsers. Besides acting as a second line of defense against XSS, CSP offers control over various types of content, outgoing connections, and the application's behavior. In this article, we elaborate on these features and provide you with a prioritized CSP deployment guide that will help you configure CSP in production. Security Policies https://pragmaticwebsecurity.com/articles/securitypolicies/csp-zero-to-hero.html bfc9d7da-ac8b-445f-b664-d22a53ee3010 Tue, 24 May 2022 00:00:00 +0000 The recommended best practice for modern CSP policies relies on hashes, nonces, and 'strict-dynamic'. Unfortunately, these features conflict with modern SPAs. This article proposes three concrete strategies to deploy secure CSP policies for SPAs. The first relies on a simple policy allowing 'self', which is acceptable under certain circumstances. The second strategy enables CSP hashes by rewriting the main page to use a script loader. The third strategy inserts nonces into a dynamically served main page. Security Policies https://pragmaticwebsecurity.com/articles/securitypolicies/deploying-csp-spa.html 0cc49ab7-300b-451c-964f-4275f9e70bdf Mon, 11 Apr 2022 00:00:00 +0000 Like them or hate them, JSON Web Tokens (JWT) are everywhere. Unfortunately, JWTs also lie at the heart of numerous API security failures. In this article, we cover seven techniques that will help you avoid JWT security pitfalls. API Security https://pragmaticwebsecurity.com/articles/apisecurity/jwt-security-pitfalls.html f7db37b0-2e18-4bad-8c48-548bc32f3155 Wed, 22 Dec 2021 00:00:00 +0000 Content Security Policy (CSP) started as a simple defense but quickly evolved into a complex security policy. This article investigates how to build an effective CSP policy to counter XSS vulnerabilities. Concretely, we use step-by-step examples to highlight bypasses against CSP and examine how to use nonces, hashes, and 'strict-dynamic' to build a robust CSP policy for modern applications. Security Policies https://pragmaticwebsecurity.com/articles/securitypolicies/xss-defense-csp.html f1958744-c977-4894-85d6-a77902070400 Mon, 13 Dec 2021 00:00:00 +0000 XSS vulnerabilities remain a top threat to any HTML-based web application. In fact, 75% of web vulnerabilities in Google's reward program are XSS vulnerabilities! Fortunately, built-in platform defenses such as Content Security Policy and Trusted Types equip us with the tools to tackle XSS. In this article, we briefly look at modern XSS vulnerabilities, followed by a detailed look at using Trusted Types policies to mitigate such vulnerabilities. In the end, we provide you with a list of concrete developer guidelines to apply Trusted Types in your projects. Security Policies https://pragmaticwebsecurity.com/articles/securitypolicies/trusted-types-spa.html d833d88f-4e85-454f-aa82-2f7325c2ee7c Tue, 15 Jun 2021 00:00:00 +0000 In this article, we investigate the security properties of refresh tokens in the browser. We investigate why frontend web applications need refresh token rotation and what we gain by using refresh token rotation. Next, we dive into concrete attack scenarios that bypass refresh token rotation and discuss how sensitive SPAs should use a backend-for-frontend to secure tokens. OAuth 2.0 & OpenID Connect https://pragmaticwebsecurity.com/articles/oauthoidc/critical-analysis-refresh-token-rotation.html c07b7f1f-f2e3-45a9-9803-eeb96c633a4f Fri, 09 Apr 2021 00:00:00 +0000 A Cross-Site Scripting (XSS) vulnerability can and will lead to the full compromise of a frontend application. An XSS vulnerability allows the attacker to control the application in the user's browser, extract sensitive information, and make requests on behalf of the application. Modern frameworks come with built-in defenses against XSS, but how far do they really go? In this article, we look at Angular's built-in XSS defenses, along with insecure coding patterns that inadvertently bypass these protections. SPA Security https://pragmaticwebsecurity.com/articles/spasecurity/angular-xss.html f356309b-7b23-47dd-924c-71bed3174714 Mon, 01 Feb 2021 00:00:00 +0000 JSON.stringify() is perhaps one of the most mundane APIs in modern browsers. The functionality to translate a JavaScript object into a string-based representation is hardly thrilling. But when the stars align, a simple JSON serialization operation can result in a significant XSS vulnerability. This article tells the nail-biting story of such a vulnerability in Scully, an Angular-based static site generator. SPA Security https://pragmaticwebsecurity.com/articles/spasecurity/json-stringify-xss.html adb94e9b-5e50-46d0-96e0-f52167d2fda4 Tue, 26 Jan 2021 00:00:00 +0000 Traditionally, OAuth 2.0 applications rely on iframes to silently obtain tokens in the background while the application remains running in the foreground. With the ongoing efforts to block third-party cookies, these flows become increasingly unreliable. Use the new version of the Flow Simulator to visualize the effects of third-party cookie blocking in Brave and Safari. OAuth 2.0 & OpenID Connect https://pragmaticwebsecurity.com/articles/oauthoidc/flow-simulator-frames.html 9b84ae49-de0c-4f7d-be1f-a71f0035d777 Tue, 24 Nov 2020 00:00:00 +0000 Frame-based attacks such as clickjacking and UI redressing may be obscure, but they are (still) very real. They even threaten APIs, which have nothing to do with iframes and web pages. This article gives an overview of the threats, discusses recent changes in framing restriction mechanisms, and provides concrete recommendations to secure modern web applications. Security Policies https://pragmaticwebsecurity.com/articles/securitypolicies/preventing-framing-with-policies.html b1e2cebd-facb-44e4-bd61-56df3ea1e178 Tue, 15 Sep 2020 00:00:00 +0000 Have you ever heard of the device flow, or the OAuth 2.0 Device Authorization Grant? If not, make sure you keep reading, as the device flow is pretty awesome to support an ever-growing group of applications. If you already know about the device flow, you should skip to the second half of the article, where we discuss the details and the surprising amount of security benefits. OAuth 2.0 & OpenID Connect https://pragmaticwebsecurity.com/articles/oauthoidc/device-flow.html 03424dbb-56be-480e-9dcc-d1a74bc97594 Tue, 18 Aug 2020 00:00:00 +0000 I often need to explain the different steps in OAuth 2.0 and OpenID Connect flows, for example during a training or consulting session. Illustrating the numerous steps with a real-world application is always challenging, especially since many of the requests are invisible to the user. That's why I built the Flow Simulator, which allows you to walk through a flow step by step, while visualizing all the relevant details. Keep reading to learn all about the publicly available Flow Simulator. OAuth 2.0 & OpenID Connect https://pragmaticwebsecurity.com/articles/oauthoidc/oauth-flow-simulator.html dacd1ce1-30b7-44ab-914c-e7436462da9b Tue, 07 Jul 2020 00:00:00 +0000 Everyone who first learns about OAuth 2.0 and OpenID Connect is confused. There are dozens of specifications with uncommon terminology and hard-to-understand scenarios. That's why I am excited to announce this free introductory course, which is the perfect starting point for your journey into OAuth 2.0 and OpenID Connect. More details are available in this article. OAuth 2.0 & OpenID Connect https://pragmaticwebsecurity.com/articles/oauthoidc/free-intro-oauth-oidc.html 1675ff60-c55b-454a-9c12-7acaf4380cd3 Wed, 01 Jul 2020 00:00:00 +0000 Preventing XSS in React is manageable when you stay within the boundaries of the framework, but becomes hard once you step out of React's safe zone. In this article, we take a closer look at escape hatches and component parsers and all the reasons you should avoid them. Read on to discover the next level of XSS in React applications. SPA Security https://pragmaticwebsecurity.com/articles/spasecurity/react-xss-part3.html 2ea0b623-aae2-4658-b454-48d98718ecec Sun, 14 Jun 2020 00:00:00 +0000 Dynamically rendering benign HTML code in React requires the use of dangerouslySetInnerHTML. That is not a naming mistake. This property is dangerous, and using it carelessly will create XSS vulnerabilities in your application. In this article, we discuss why the property is there, how you can use it, and how the Signal messenger misused it. This article is the second in a series of three, and a must-read for every React developer. SPA Security https://pragmaticwebsecurity.com/articles/spasecurity/react-xss-part2.html 5fda67fc-7eac-4707-923c-7679b02c7c60 Thu, 28 May 2020 00:00:00 +0000 Good audio for virtual presentations is absolutely critical. Even before the new world of 2020, I was delivering remote training and recording videos, so I invested in a decent audio setup. Since the Corona pandemic coincided with the birth of our third child, training from home sure became a totally new challenge. To make that as comfortable as possible, I built myself a standing desk and added a dedicated camera to the setup. A few people asked about my setup, I decided to provide a bit more details in this article. Productivity https://pragmaticwebsecurity.com/articles/productivity/idiot-proof-audio-recording.html d7402f40-91db-4b7d-ac78-a976ac3a6046 Thu, 21 May 2020 00:00:00 +0000 A Cross-Site Scripting (XSS) vulnerability can and will lead to the full compromise of a frontend application. An XSS vulnerability allows the attacker to control the application in the user's browser, extract sensitive information, and make requests on behalf of the application. Modern frameworks come with built-in defenses against XSS, but how far do they really go? In this article series, we look at how React prevents XSS, but also how its shortcomings leave a lot in the hands of a developer. This article is the first in a series of three. SPA Security https://pragmaticwebsecurity.com/articles/spasecurity/react-xss-part1.html 1bd54c56-0c3c-4fc0-8cc9-c0a9c31487ad Wed, 13 May 2020 00:00:00 +0000 About a year ago, the OAuth 2.0 Implicit flow became deprecated. That decision caused a lot of confusion and frustration. In this article, we analyze the different OAuth 2.0 flows to find out why the OAuth working group made that decision. Read on to find out about current best practices for using OAuth 2.0 in modern web applications. OAuth 2.0 & OpenID Connect https://pragmaticwebsecurity.com/articles/oauthoidc/from-implicit-to-pkce.html ac39e626-7423-4929-9589-9bd797608bec Thu, 07 May 2020 00:00:00 +0000 Single Page Applications can use refresh tokens in the browser. Yes, you read that right. This new development is awesome, because it makes access token renewal much more elegant. However, refresh tokens in the browser require additional security measures, such as refresh token rotation. We discuss the pros and cons of refresh token rotation, along with the potential dangers. In the end, you will find five strategies you can use to secure your tokens in your web frontends better. OAuth 2.0 & OpenID Connect https://pragmaticwebsecurity.com/articles/oauthoidc/refresh-token-protection-implications.html 3abac397-8dff-46aa-b4be-7b8d6ecff005 Thu, 30 Apr 2020 00:00:00 +0000 Most developers are afraid of storing tokens in LocalStorage due to XSS attacks. While LocalStorage is easy to access, the problem actually runs a lot deeper. In this article, we investigate how an attacker can bypass even the most advanced mechanisms to obtain access tokens through an XSS attack. Concrete recommendations are provided at the end. OAuth 2.0 & OpenID Connect https://pragmaticwebsecurity.com/articles/oauthoidc/localstorage-xss.html 70e373db-3516-42f7-8fad-f409d89ef1ed Thu, 16 Apr 2020 00:00:00 +0000 URL parameters are straightforward to send information along in a request. Decades ago, we already used them to transport session identifiers, and today, many applications still use them for all kinds of purposes. But are URL parameters secure? What alternatives are there? Keep reading to find out more. API Security https://pragmaticwebsecurity.com/articles/apisecurity/tamper-proof-params-jwt.html 5cacef05-19a9-4096-8b9f-cf07c4ba414d Tue, 14 Apr 2020 00:00:00 +0000 In spite of the popularity of JWTs, their security properties are often unknown or misunderstood. How do you choose the signature scheme for a JWT? What other properties should you verify before trusting a JWT? How do you handle key rotation and key management? Read on for a deep-dive into JWT security. API Security https://pragmaticwebsecurity.com/articles/apisecurity/hard-parts-of-jwt.html b2423a74-929e-440d-9d00-1e445ffa2897 Fri, 13 Mar 2020 00:00:00 +0000