Authorization-code flow moves access-token delivery to the token endpoint rather than returning an access token in the browser-facing authorization redirect. That distinction reduces exposure in URLs, but does not mean a browser can never hold a token. The client architecture determines who exchanges the code and where the resulting credentials live. ...
Request smuggling occurs when components disagree about HTTP message boundaries and an attacker exploits the disagreement. In a proxy chain, bytes treated as one request’s body by the front end may become another request at the back end. The important evidence is inconsistent parsing and forwarding, not simply finding two HTTP status lines in a response capture. ...
A signed JWT carries claims whose integrity can be checked without looking up the entire token in a session table. That convenience does not make its contents confidential, establish authorization, or prevent replay. Start with the token format and the application’s validation contract, then test each boundary independently. A successful cryptographic check is one input to an access decision, not the decision itself. ...
Parameter binding gives a database value a designated position in a SQL statement. A name containing a quote or a semicolon remains a value instead of becoming another clause. Reusing a named prepared statement adds a separate optimization: the server can retain statement information across executions in one session. Safe binding does not require the application to create a named statement for every query. ...
Setuid on a Linux executable can change the process’s effective user ID to the file owner’s ID when exec succeeds. It does not replace every credential with the owner’s login identity. A privileged helper can therefore perform a controlled operation on another account’s behalf, but its input handling and privilege lifetime become part of the security boundary. The mode bit alone proves neither that a transition occurred nor that the helper is safe. ...
A shared temporary directory is a namespace other users may also write to, not a guarantee that every file inside is public. File permissions still control content access. The dangerous assumption is that choosing a pathname gives your process ownership of whatever already occupies it. Create a new object atomically and keep using the returned handle instead of trusting a predictable name. ...
Clickjacking deceives a user about which interface receives an action. A hostile parent can place a framed application behind a misleading visual layer so that a click reaches a real control in that application. The parent need not read the child’s DOM for the user to interact with it. Same-origin read restrictions therefore do not replace a decision about whether the application may be embedded at all. ...
XML external entity processing can make a parser resolve a document-controlled reference using the application’s access. Depending on the parser and its configuration, this can expose files or initiate requests to other services. XML support alone does not establish vulnerability: identify the actual parser, enabled features, resolver and downstream processing before deciding what an input can do. ...