# Web Application Security - Link: https://www.agilicus.com/blog/web-app-security/ - Published: 2020-12-25T21:14:49+00:00 - Author: Don Bowman 1. [Home](https://www.agilicus.com/) 2. [Blog](https://www.agilicus.com/blog/) 3. Web Application Security ![about-agilicus](https://www.agilicus.com/www/9f15eb3a-about-hero-01.svg) Protect The Page --- ## Web Application Security ## Web Application Security Web Applications are the dominate form of how most of us interact with data. From the early days of the world-wide-web where it was a read-only view of data we have evolved to highly dynamic 2-way real-time views of everything we hold dear. Securing a web application is complex owing to the many risks. And, it is certainly an area many sites can improve. ## Articles * [⌊When the Foundation Fails: PHP2Shell and the eMudhra Certificate Compromise⌉⌊ When the Foundation Fails: PHP2Shell and the eMudhra Certificate Compromise⌉[ * ## 󠀁[When the Foundation Fails: PHP2Shell and the eMudhra Certificate Compromise](https://www.agilicus.com/when-the-foundation-fails-php2shell-and-the-emudhra-certificate-compromise/)󠁿 * Two incidents in one week expose broken foundations: PHP2Shell hides in unpatchable embedded firmware, while eMudhra generated certificate authority keys with single- digit entropy. Don Bowman explains why conventional perimeter defences fail and how granular identity-based authorisation restores control. * [⌊Same Old Shenanigans: The MITRE 2025 Top 25 List⌉⌊Same Old Shenanigans: The MITRE 2025 Top 25 List⌉[ * ## 󠀁[Same Old Shenanigans: The MITRE 2025 Top 25 List](https://www.agilicus.com/same-old-shenanigans-the-mitre-2025-top-25-list/)󠁿 * MITRE has released the 2025 CWE Top 25 list, and it is a stark reminder that software is still porous. We analyse the rise of authorization failures and the return of buffer overflows. * [⌊GoDaddy Got Got: Multi-Year Breach⌉⌊GoDaddy Got Got: Multi-Year Breach⌉[ * ## 󠀁[GoDaddy Got Got: Multi-Year Breach](https://www.agilicus.com/godaddy-got-got-multi-year-breach/)󠁿 * A multi-year attack involving 1.2M customers, hosting, DNS. What could the miscreants have achieved? DKIM? SSL? Domain verification? * [⌊Protecting Against the OWASP Top 10 Web Application Vulnerabilities⌉⌊Protecting Against the OWASP Top 10 Web Application Vulnerabilities⌉[ * ## 󠀁[Protecting Against the OWASP Top 10 Web Application Vulnerabilities](https://www.agilicus.com/protecting-against-the-owasp-top-10/)󠁿 * The OWASP Top 10 is a standard awareness document that outlines the most critical web application security risks and vulnerabilities. Learn how Agilicus AnyX is designed to eliminate an attacker’s visibility into the potential OWASP Top 10 web application vulnerabilities. * [⌊Industrial Air Gap – A Tale Of 2 Users⌉⌊Industrial Air Gap – A Tale Of 2 Users⌉[ * ## 󠀁[Industrial Air Gap – A Tale Of 2 Users](https://www.agilicus.com/industrial-air-gap-a-tale-of-2-users/)󠁿 * Industrial devices are hard to secure. Commonly done only via direct local access. Teams, however, wish remote access to improve efficiency. A solution to this battle is Zero Trust. * [⌊Multi-Factor Authentication And The Supply Chain⌉⌊Multi-Factor Authentication And The Supply Chain⌉[ * ## 󠀁[Multi-Factor Authentication And The Supply Chain](https://www.agilicus.com/multi-factor-authentication-and-the-supply-chain/)󠁿 * A high(ish) profile nodejs library is compromised. No multi-factor authentication used by developer. The ripples are far and wide. Including you! * [⌊The Personal Verification Question: Password’s Dumb Cousin⌉⌊The Personal Verification Question: Password’s Dumb Cousin⌉[ * ## 󠀁[The Personal Verification Question: Password’s Dumb Cousin](https://www.agilicus.com/the-personal-verification-question-passwords-dumb-cousin/)󠁿 * The personal verification question. The dumb, slow cousin of the password. Stored in plaintext, findable in social media. Not multi-factor auth * [⌊Add multi-factor authentication to old applications⌉⌊Add multi-factor authentication to old applications⌉[ * ## 󠀁[Add multi-factor authentication to old applications](https://www.agilicus.com/add-multi-factor-old-applications/)󠁿 * Your cyber insurance is up for review. IGet all applications authenticated with multi-factor, simply, quickly, compliantly. * [⌊Re-Using your Multi-Factor Authentication To Prove Humanity⌉⌊Re-Using your Multi-Factor Authentication To Prove Humanity⌉[ * ## 󠀁[Re-Using your Multi-Factor Authentication To Prove Humanity](https://www.agilicus.com/re-using-your-multi-factor-authentication-to-prove-humanity/)󠁿 * Spam. The cat and mouse game of advertisers seeking to reach more people for less cost, and, people seeking to spend more to not be reached. The current state of the art in proving “I am not a spam-sending robot” is the captcha. Do you love the captcha? Me neither. Do you sometimes fail it? Me too! * [⌊Angular Content-Security-Policy Complex Nonce: Google Tag Manager⌉⌊Angular Content-Security-Policy Complex Nonce: Google Tag Manager⌉[ * ## 󠀁[Angular Content-Security-Policy Complex Nonce: Google Tag Manager](https://www.agilicus.com/angular-content-security-policy-google-tagmanager/)󠁿 * Content-Security-Policy protects our application, but challenging with external scripts like Google Tag Manager. We show in Angular Single Page Application. * [⌊Let’s Encrypt X3 to R3 and Certificate Transparency Logs⌉⌊Let’s Encrypt X3 to R3 and Certificate Transparency Logs⌉[ * ## 󠀁[Let’s Encrypt X3 to R3 and Certificate Transparency Logs](https://www.agilicus.com/let-encrypt-x3-to-r3-transparency-logs/)󠁿 * Certificate Transparency Logs in SSL can be a useful diagnostic tool as well as a security forensic. * [⌊OAuth 2.0 Protected Resource Threats⌉⌊OAuth 2.0 Protected Resource Threats⌉[ * ## 󠀁[OAuth 2.0 Protected Resource Threats](https://www.agilicus.com/oauth-2-0-protected-resource-threats/)󠁿 * The OAuth 2.0 protected resource. It takes the access token and uses it to grant access. Watch out for it becoming compromised. * [⌊OAuth 2.0 Refresh Token Threats⌉⌊OAuth 2.0 Refresh Token Threats⌉[ * ## 󠀁[OAuth 2.0 Refresh Token Threats](https://www.agilicus.com/oauth-2-0-refresh-token-threats/)󠁿 * OAuth 2.0 refresh tokens are used to obtain new access tokens on the user’s behalf. If lost, they can allow an attacker to masquerade. * [⌊OAuth 2.0 Token Endpoint Threats⌉⌊OAuth 2.0 Token Endpoint Threats⌉[ * ## 󠀁[OAuth 2.0 Token Endpoint Threats](https://www.agilicus.com/oauth-2-0-token-endpoint-threats/)󠁿 * The OAuth 2.0 Token Endpoint. Its were authorisation becomes real. Secure it to prevent guessing * [⌊OAuth 2.0 Authorisation Endpoint Threats⌉⌊OAuth 2.0 Authorisation Endpoint Threats⌉[ * ## 󠀁[OAuth 2.0 Authorisation Endpoint Threats](https://www.agilicus.com/oauth-2-0-authorisation-endpoint-threats/)󠁿 * OAuth 2.0 Authorisation Endpoints are the front-door skeleton-key creator of all your front-doors. So protect them carefully. * [⌊OAuth 2.0 Client Threats⌉⌊OAuth 2.0 Client Threats⌉[ * ## 󠀁[OAuth 2.0 Client Threats](https://www.agilicus.com/oauth-2-0-threat-model-and-security-considerations-1/)󠁿 * OAuth 2.0 and the client. Use Defense In Depth. Secure the client, and then assume it can still be compromised. Zero Trust. * [⌊OAuth 2.0 Threat Model and Security Considerations⌉⌊OAuth 2.0 Threat Model and Security Considerations⌉[ * ## 󠀁[OAuth 2.0 Threat Model and Security Considerations](https://www.agilicus.com/oauth-2-0-threat-model-and-security-considerations/)󠁿 * OAuth 2.0 has simplified authentication and authorisation for many applications, shifting from custom code to simple library import. However, as more applications come to rely on it, this makes its weaknesses more interesting. An attacker can gain access to a broader set of data via a smaller set of tactics and techniques. First lets understand the threat areas, and then, the best current practices for addressing them. * [⌊OAuth 2.0 Proof of Possession⌉⌊OAuth 2.0 Proof of Possession⌉[ * ## 󠀁[OAuth 2.0 Proof of Possession](https://www.agilicus.com/oauth-2-0-proof-of-possession/)󠁿 * OAuth 2.0 replaced Proof of Possession with Bearer Tokens for simplicity, a controlversial decision. A new draft brings them back. * [⌊OAuth 2.0 Access Token Demonstrate Proof of Possession⌉⌊OAuth 2.0 Access Token Demonstrate Proof of Possession⌉[ * ## 󠀁[OAuth 2.0 Access Token Demonstrate Proof of Possession](https://www.agilicus.com/access-token-dpop/)󠁿 * Theft of an Access Token need not be a complete loss. Learn how Demonstration of Proof Of Possession can reduce this risk. * [⌊Blurring the web and the app: web push⌉⌊Blurring the web and the app: web push⌉[ * ## 󠀁[Blurring the web and the app: web push](https://www.agilicus.com/web-push-notifications/)󠁿 * Web push. An important part of making web applications peer to native, and more secure, more accessible. * [⌊My team works outside, why can’t their Kronos Timesheet?⌉⌊My team works outside, why can’t their Kronos Timesheet?⌉[ * ## 󠀁[My team works outside, why can’t their Kronos Timesheet?](https://www.agilicus.com/outside-team-inside-kronos-zero-trust-solution/)󠁿 * Access your on-premise Kronos from any user, from any device, from any network. Increased security, increased simplicity. Zero Trust Networking. * [⌊The JWT Bearer Token: You On The Wire⌉⌊The JWT Bearer Token: You On The Wire⌉[ * ## 󠀁[The JWT Bearer Token: You On The Wire](https://www.agilicus.com/jwt-token-is-you-on-the-wire/)󠁿 * A bearer token is a cryptographic representation of who (you) and what (authorisation) that is used on a per-transaction basis. Learn and Use! * [⌊Take time to stop and sniff the mime type⌉⌊Take time to stop and sniff the mime type⌉[ * ## 󠀁[Take time to stop and sniff the mime type](https://www.agilicus.com/take-time-to-stop-and-sniff-the-mime-type/)󠁿 * Happy Eyeballs? Mime-Type-Sniffing? Security wins, don’t infer content type from file name. * [⌊WEB SECURITY 101⌉⌊WEB SECURITY 101⌉[ * ## 󠀁[WEB SECURITY 101](https://www.agilicus.com/web-security-101/)󠁿 * January 2020 Waterloo Technology Chautauqua, Web Security 101 * [⌊USE OF POSTMAN WITH OPENID CONNECT PKCE AND API⌉⌊USE OF POSTMAN WITH OPENID CONNECT PKCE AND API⌉[ * ## 󠀁[USE OF POSTMAN WITH OPENID CONNECT PKCE AND API](https://www.agilicus.com/use-of-postman-with-openid-connect-pkce-and-api/)󠁿 * Many API’s, Agilicus’ included, use OpenAPI to specify how they function. Authentication of these is usually left out of scope, but, provided as a bearer token. This means that if you write a web application, you want to directly use the RESTful API’s, and you do so by first authenticating via OpenID Connect PKCE flow and remembering the access token. * [⌊Zero Trust: Connecting The Digitally Disconnected⌉⌊Zero Trust: Connecting The Digitally Disconnected⌉[ * ## 󠀁[Zero Trust: Connecting The Digitally Disconnected](https://www.agilicus.com/zero-trust-connecting-the-digitally-disconnected/)󠁿 * Digitally Disconnected. The 2nd class citizens of the 21st Century. Unable to access data due to identity or VPN. NO MORE! Zero Trust. * [⌊Static Application Scanning Angular: Resolving lodash npm audit⌉⌊Static Application Scanning Angular: Resolving lodash npm audit⌉[ * ## 󠀁[Static Application Scanning Angular: Resolving lodash npm audit](https://www.agilicus.com/static-application-scanning-angular-lodash/)󠁿 * Static Application Scanning with Angular can sometimes block release with no solution. Learn about better-npm-audit. * [⌊Secure the Cookie!⌉⌊Secure the Cookie!⌉[ * ## 󠀁[Secure the Cookie!](https://www.agilicus.com/secure-the-cookie/)󠁿 * The humble cookie. So controversial. So complex to secure. If your web app must have them, you must secure them. * [⌊Fixing the case of the Implicit Flow modification⌉⌊Fixing the case of the Implicit Flow modification⌉[ * ## 󠀁[Fixing the case of the Implicit Flow modification](https://www.agilicus.com/fixing-the-case-of-the-implicit-flow-modification/)󠁿 * Meet Hank. Hank is a web application with a dark secret. It trusts you the user to not change things in the browser. Bad Hank. Learn how to fix it! * [⌊Why should I use Content-Security-Policy?⌉⌊Why should I use Content-Security- Policy?⌉[ * ## 󠀁[Why should I use Content-Security-Policy?](https://www.agilicus.com/why-should-i-use-content-security-policy/)󠁿 * The Content-Security-Policy headers exists to protect the users of your web site from the content they themselves might create. [Next Page](https://www.agilicus.com/blog/web-app-security/?output_format=markdown&query-20-page=2)