Topic hub
Web Security & WAF
OWASP Top 10, XSS, CSRF, injection, SSRF, security headers, WAFs, rate limiting and bot protection.
Lessons
- XSS and Output Escaping · PHP 8: Modern PHP Development
Escape output by context and use templates that auto-escape. - CSRF, CORS and Cookie Security · Web Security and WAF
How browsers send credentials, and how to keep cross-site requests safe. - Injection: SQL, NoSQL, Command and Template · Web Security and WAF
Stop untrusted input from becoming code. - The OWASP Top 10 (2025) · Web Security and WAF
The most critical web application security risks and what they mean for developers. - Broken Access Control and SSRF · Web Security and WAF
Object-level authorization, privilege escalation and server-side request forgery. - Cross-Site Scripting and Content Security Policy · Web Security and WAF
Prevent script injection with output encoding, sanitization and CSP. - Rate Limiting and Bot Defense · Web Security and WAF
Protect logins, APIs and expensive endpoints from abuse. - Web Application Firewalls and Edge Protection · Web Security and WAF
What WAFs do, how to tune them, and how CDNs absorb attacks. - The OWASP API Security Top 10 (2023) · API Security in Depth
The ten most common API risks and how they differ from classic web risks. - Server-Side Request Forgery (SSRF) · API Security in Depth
When your API fetches URLs on a user's behalf. - Security Misconfiguration: TLS, CORS, Headers & Errors · API Security in Depth
Hardened defaults for every API deployment. - Security Testing APIs in CI · API Security in Depth
SAST, dependency scanning, DAST, fuzzing and authorization tests. - Unsafe Consumption of APIs & Webhook Security · API Security in Depth
Treat third-party APIs and inbound webhooks as untrusted input. - Prompt Injection & Agent Security · Integrating LLM APIs
Direct and indirect injection, and designing systems that stay safe anyway. - PCI DSS Scope, Tokenization & Payment Security · Payments & Money APIs
Keep card data out, secure what remains, and handle credentials safely. - Defending Login and Account Endpoints · Rate Limiting, Quotas & Abuse Protection
Credential stuffing, brute force, OTP abuse and account enumeration. - Webhook Security · Real-Time APIs
Signatures, secrets rotation, SSRF protection and payload safety.
Decision guides
- Hosted Checkout vs Embedded Fields vs Direct API
- Rate-Limit Algorithms Compared
- Sessions vs JWT vs Opaque Tokens for Mobile Apps
Cookbook recipes
- Implement rate limiting in a PHP API · PHP
- Rate limit a Spring Boot API with Redis · Spring Boot
- Rate limit FastAPI endpoints with Redis · FastAPI
- Rate limit Route Handlers and Server Actions · Next.js
- Add a Content Security Policy with nonces in Next.js · Next.js
- Rate limit an Express API across instances · Node.js
- Add CSRF protection to PHP forms · PHP
- Prevent XSS in PHP templates · PHP
- Call a cookie-authenticated API with CSRF protection · React