Documentation
README
CSRF
Cross-site request forgery abuses ambient authority (cookies, HTTP auth) across origins. Do not rely on CORS alone; enforce non-replayable tokens and strict origin checks for every state change.
Attack Surface
Session Types
- Web apps with cookie-based sessions and HTTP auth
- JSON/REST, GraphQL (GET/persisted queries), file upload endpoints
Authentication Flows
- Login/logout, password/email change, MFA toggles
OAuth/OIDC
- Authorize, token, logout, disconnect/connect endpoints
This is the opening of the README. Read the full README on GitHub.