Information security
Transport security, web hardening and the attacks that shaped today's identity protocols.
Topics: Authorization · Cloud computing · Events & community · General · Identity & access management · Federation · Information security · Mobile security · Social login · News · Technical · Archives
- Information security
POODLE and the End of SSLv3, TLS 1.0 and TLS 1.1
How the 2014 POODLE attack broke SSLv3, why RFC 7568 and RFC 8996 later retired SSLv3, TLS 1.0 and 1.1, and which TLS settings to use for identity and API servers.
- Authorization
The State Parameter in OAuth 2.0: CSRF, PKCE and RFC 9700
Why OAuth 2.0's state parameter exists, the CSRF attack it stops, how to generate and check it, and how state, PKCE and nonce divide the work under RFC 9700.
- Information security
Adding HSTS to PingFederate and Other Jetty-Based Servers
How to send Strict-Transport-Security from PingFederate and other Jetty-based servers: response header config files, Jetty rewrite rules, or a reverse proxy.
- Information security
Locking Down a Federation Server: Expose Only What You Must
How to shrink the attack surface of PingFederate or any federation server: separate admin and runtime, allowlist endpoints at the proxy, and add security headers.
- Events & community
API Security Today: The OWASP API Top 10 in Practice
A talk-style tour of the OWASP API Security Top 10 (2023): broken object level authorization, authentication flaws, resource limits, and fixes that work.
- Cloud computing
Cloud Security Standards: Frameworks and Identity Specs
Which standards matter for cloud security: CSA Cloud Controls Matrix, ISO/IEC 27001, 27017 and 27018, SOC 2, plus the identity specs (SAML, OIDC, SCIM) behind them.
- Authorization
Implementing Modern OAuth Techniques: PAR, DPoP and More
The OAuth 2.0 extensions worth adopting now: PKCE everywhere, pushed authorization requests, DPoP, issuer identification, resource indicators and token exchange.