Web App Security
CORS, CSP, injection and the browser-facing attack surface.
5 articles
Blocked by CORS Policy: Stop Reaching for Access-Control-Allow-Origin: *
The wildcard breaks the moment you send cookies, and reflecting the Origin header is worse. Here is the allowlist pattern, the nginx config and the curl test that proves it.
CSP 'unsafe-inline' Is Not a Fix: Nonces That Work in Next.js
Adding 'unsafe-inline' to silence CSP violations turns the header into compliance theatre. Here is the per-request nonce setup for Next.js that keeps hydration working.
Storing JWTs in localStorage Turns Any XSS Into Account Takeover
Every JWT tutorial puts the token in localStorage. Here is what that costs when XSS lands, and the in-memory access token plus HttpOnly refresh cookie setup that replaces it.
IP Rate Limiting Won't Stop Credential Stuffing: What Actually Does
Distributed credential stuffing rotates thousands of IPs, each trying once, sliding under every per-IP limit. Here is the per-account, breached-password and MFA stack that stops it.
FastAPI CORS Silently Failing: the allow_credentials Plus Wildcard Trap
FastAPI CORS with allow_credentials=True and allow_origins=['*'] passes testing then breaks once cookies flow. The browser blocks it silently. Here is why and the fix.