A tiny fix with big impact and high risk

This page summarizes the projects mentioned and recommended in the original post on dev.to
API developer-tools Rust Security security-tools

InfluxDB - Power Real-Time Data Analytics at Scale
Get real-time insights from all types of time series data with InfluxDB. Ingest, query, and analyze billions of data points in real-time with unbounded cardinality.
www.influxdata.com
featured
SaaSHub - Software Alternatives and Reviews
SaaSHub helps you find the best software and product alternatives
www.saashub.com
featured

  • secutils

    Secutils.dev is an open-source, versatile, yet simple security toolbox for engineers and researchers (by secutils-dev)

    • If we blindly redirect the user to whatever URL is embedded in the next query string parameter, we run the risk of becoming an easy phishing target. Imagine someone shares the following link with you: https://secutils.dev/signin?next=%2F%2Fws-secutils.dev%2Fws%2Fweb_scraping. The main domain looks legit, and it’s not easy to notice that the next parameter includes a URL to a completely different website - https://ws-secutils.dev/ws/web_scraping. Malicious actors can exploit various tricks and browser quirks to conceal the real destination in the next parameter. For example, here I used a URL-encoded protocol-relative URL (// instead of https://).

  • secutils-webui

    The web user interface for Secutils.dev

    • The example above shows that you absolutely have to validate all URLs you redirect users to if there is a chance they can be manipulated by third parties. In the Secutils.dev Web UI, specifically, I rely on the native URL class to check if the URL has the proper origin before redirecting the user. Also, check out "Preventing Unvalidated Redirects and Forwards" from OWASP for more tips.

  • InfluxDB

    Power Real-Time Data Analytics at Scale. Get real-time insights from all types of time series data with InfluxDB. Ingest, query, and analyze billions of data points in real-time with unbounded cardinality.

    InfluxDB logo
NOTE: The number of mentions on this list indicates mentions on common posts plus user suggested alternatives. Hence, a higher number means a more popular project.

Suggest a related project

Related posts

  • Explore web applications through their content security policy (CSP)

    1 project | dev.to | 28 Nov 2023

  • Q4 2023 iteration: tracking arbitrary web content, user-specific webhook subdomains, inherited CSP, and more

    1 project | dev.to | 31 Oct 2023

  • Announcing 1.0.0-alpha.3 release: more powerful resource tracking, notifications and content sharing

    2 projects | dev.to | 24 Oct 2023

  • Building a scheduler for a Rust application

    1 project | dev.to | 26 Sep 2023

  • A plan for Q3 2023 iteration

    2 projects | dev.to | 21 Sep 2023