3 posts tagged with "Authentication"

A security scanner reports: 3,148 authorization requests are missing PKCE.

…and suddenly that sounds like 3,148 vulnerabilities. Or is it?

Sign in with Google, the signature verifies, and the token is valid. PKCE checks out, the redirect_uri matched exactly, state came back untouched. Textbook flow, start to finish. Then the application runs find_user_by_email(claims.email), and the session goes to whoever controls that address.

Ten of the OAuth and OIDC vulnerability reports we read end that way. In none of them did the protocol fail. It ran perfectly and handed over the account anyway.

Modern e-commerce platforms increasingly rely on distributed API architectures to power web and mobile applications. But as architectures shift toward interconnected microservices, the most dangerous bugs are found in the way data flows in the applications.

Recently, we conducted a structured security evaluation of a large-scale e-commerce API ecosystem. Rather than focusing on isolated vulnerabilities, the research aims to identify systemic patterns of failure across authentication flows, parameter handling, and microservice interactions.

Our mission: to see if we could break the business rules of a production environment using nothing but an interception proxy and a bit of creative curiosity.