47
IDOR is not dead, it just moved to the second request
Every team I test has learned to check ownership on GET /orders/:id. Almost none of them check it on the thing the order links to. The pattern I keep finding: The second endpoint…
3 comments →Web & API
Injection, auth, business logic, and everything that talks over HTTP.
96
Race conditions: the two-request trick that still works
Any endpoint that checks a limit and then acts on it is worth two requests fired together. Coupon redemption, withdrawal, invite acceptance, vote casting. The check and the write…
No comments →