You're viewing the readable version of this site. The interactive extras (search, diagrams, read-aloud) need JavaScript and a current browser. Enable JavaScript; if it is already enabled, update your browser.

Tag

Notes tagged “sessions”

Every note filed under sessions, newest first.

A filtered view of the notes.

2026

  1. One Defect, Three Surfaces

    CORS allowlists, OAuth redirect URIs and open redirects have separate vulnerability literatures and the same bug — a structured identifier tested with a string operation. The fix is one sentence, and a standards body finally wrote it down.

    security web oauth jwt sessions authentication dissecting-systems

  2. The Credential That Predates the Origin

    Cookies do not obey the same-origin policy — they never have. Thirty years of attributes, flags and name prefixes are one long retrofit, and knowing which parts actually hold is most of session security.

    security web cookies sessions http browsers dissecting-systems