Head code: let the operator paste what ad networks need
Ad networks require script tags in the head. Restricting what can go there makes the product unusable, so restrict who can set it instead — and keep popunder loaders off public pages.
Tagged “security”
13 entries
Never let a provider error leak your API token
The request URL contains your key. Flash it in an error and anyone who can make the provider fail can read it.
Scoped keys: give the faucet the smallest one that works
v2 keys carry scopes. A faucet needs send and read; anything with admin scope on a web server is a wallet waiting to be emptied.
Check the AdsLab sender IP, and what Cloudflare does to it
Their postbacks come from one address. Enforcing it is free — unless you are behind Cloudflare, where REMOTE_ADDR is Cloudflare and the check rejects everything.
Keep the config file out of every release you ship
A sample committed, the real one ignored, the release built by exclusion, and a web server rule that refuses to serve either.
Security headers, and how to allow or refuse framing
Set the cheap headers everywhere. Framing is the one to decide deliberately: a site that refuses to be embedded cannot be shown in a rotator or an exchange.
An audit log you will actually be glad you kept
Every admin action and every login, with who, what, from where. Append-only, and never editable from the panel that writes it.
Suspend an account without deleting it
A status column, one check in the session guard, and a shadow-banned tier that keeps working while earning nothing.
Throttle logins by account and by address, separately
One attacker with many addresses and many attackers on one address are different attacks. A single counter catches only one of them.
Two-factor authentication in plain PHP, no library
TOTP is HMAC-SHA1 over a time counter, truncated to six digits. About forty lines, and it works with every authenticator app.
CSRF tokens without a framework
One token per session, compared in constant time, checked on every state-changing POST. Twenty lines and no dependency.
Session cookie settings that survive a security review
Five flags and one call to regenerate. Defaults leave the session cookie readable by scripts and sendable over plain HTTP.
Fetch a user-supplied URL without opening an SSRF hole
Postback URLs, webhook targets and site verification all mean fetching an address someone else chose. This is the guarded version.