Security
TLS, authentication and hardening - defensive, protective guidance, and the widely-repeated advice that quietly leaves you exposed.
Sub-topics
TLS & Certificates
23Let's Encrypt, certbot, renewals and chain problems.
Authentication
16JWT, OAuth, sessions and the token mistakes that hand over accounts.
Web App Security
5CORS, CSP, injection and the browser-facing attack surface.
Hardening & Secrets
13SSH, firewalls, secrets and locking down a server without locking yourself out.
62 articles · showing 1-9 (page 1 of 7)
Exactly-once over an unreliable pipe: HMAC, nonces, and a byte-exact contract
A per-request nonce and a per-content hash look like the same idea and are not. One says this request arrived twice, the other says this message arrived twice, and a payment pipeline needs both. The signing design behind a production SMS gateway.
Deploying Frappe apps to a client server you're not allowed to touch
The client will not give you access to their dev server, so every code change means someone on their side pulls and migrates by hand. Here is the complete fix: a self-hosted runner they install, a deploy script they own, and no credential to their environment on your side at all.
Bolting a phone onto ERPNext: custom routes, guest endpoints and HMAC auth in Frappe
Frappe claims every /api/* path before website routing, so a fixed third-party path 404s. Here is the before_request rewrite that fixes it, including the cached property you also have to bust, and why allow_guest endpoints can still be strongly authenticated.
Push access is code execution: hardening a self-hosted runner
A self-hosted runner executes whatever the workflow file says, and the workflow file lives in a repository you control. So push access to your repository is command execution on your client's server. Here is the honest risk and the layers that contain it.
Secrets, environments and required reviewers
A repository secret is readable by everyone who can push to the repository. An environment secret is not released until a gate opens. Understanding that difference is what lets you hand the client the key to their own deployments.
Access is a liability, not a convenience
Every SSH key you hold on a client's server is a credential you now have to defend, insure and explain. The strongest position in an enterprise procurement conversation is not having it at all.
Blocked by CORS Policy: Stop Reaching for Access-Control-Allow-Origin: *
The wildcard breaks the moment you send cookies, and reflecting the Origin header is worse. Here is the allowlist pattern, the nginx config and the curl test that proves it.
Your Cert Automation Should Default to Let's Encrypt Staging
Five test renewals can exhaust the duplicate certificate limit and block a real renewal for a week. Here is why certbot drifts to production, and the directory split that prevents it.
Certbot connection refused on http-01: diagnosing proxies, IPv6 and port 80
Connection refused is not the same as a timeout, and the difference tells you exactly where to look. A diagnostic order for failed Let's Encrypt http-01 challenges.