The network for creativity
Join 1.25M professional creatives like you
Connect with clients, get discovered, and run your business 100% commission-free
Creatives on Contra have earned over $150M and we are just getting started
Back to feedPost
OWASP A02: Cryptographic Failures
š OWASP A02 ā Cryptographic Failures Assessment
Overview
Conducted a manual assessment focusing on the protection of sensitive data during storage and transmission.
What I Found
Sensitive information exposed inside JWTs
JWT information disclosure
Missing Secure, HttpOnly, and SameSite cookie attributes
HTTP used instead of HTTPS
Stack trace and debug information disclosure
Application version disclosure
Impact
Sensitive information leakage can assist attackers in account compromise, session theft, and application reconnaissance.
Mitigation
Avoid storing sensitive data inside JWTs.
Enforce HTTPS across the application.
Configure cookies with Secure, HttpOnly, and SameSite.
Disable verbose error messages in production.
Minimize unnecessary information disclosure.
Tools Used
Burp Suite Professional
JWT Decoder
Browser Developer Tools
The network for creativity
Join 1.25M professional creatives like you
Connect with clients, get discovered, and run your business 100% commission-free
Creatives on Contra have earned over $150M and we are just getting started
Trending
Claude
Claude has entered the design space. How are you using it?
Contra University
Learn from expert creatives how to earn more using next-gen AI tools.
Brand Design
The best brand designers are on Contra. Scroll to see what's trending in brand design. What are you building?
creativeaiflow
Creative AI workflows are evolving. What tools do you use, and what are their strengths and weaknesses?
freelancerlife
Freelancer life is wins, pivots, and everything in between. Whatās yours right now?
Related posts
ā¢ 1d
After 157 commits spanning 8 months, one thing became clear...
Just how non-negotiable security is.Ā
I'm not taking about rate limits, or protecting your secrets like API keys, or broken auth, or prevention against XSS or SQL injection, or not committing dotENV to github, or updating privacy policy if you're using any user data, or server side validation... Or anything that comes under OWASP basics.Ā
They have to be there in the first place. From day one.Ā
I refer to subtle race conditions that even an intelligentĀ LLM can sometimes fail to identify. A database leak. Like what happens when a database fails? How does the applicationĀ handle it? What happens to payments during that period? How to manage similar threats?
Adversaries wait for just one tiny opportunity...
P.S., I'm open to freelance contract or role opportunities. I can build fully secure backend and the frontend system and ship it. If you know of any opportunities, please say hi. Or connect me on LinkedIn : https://linkedin.com/in/wajidfarooq
ā¢ 1d
šØ Is Your Business Email Protected?
Many businesses assume their email is secure because it's hosted on Google Workspace or Microsoft 365. In reality, your domain still needs proper authentication to protect against spoofing, phishing, and poor email deliverability.
Here are three essentials every business should have:
ā
SPF ā Authorizes trusted mail servers to send emails on behalf of your domain.
ā
DKIM ā Digitally signs outgoing emails to verify they haven't been altered.
ā
DMARC ā Tells receiving mail servers how to handle unauthenticated emails while providing valuable reporting.
These three records not only strengthen your email security but also improve the chances of your emails reaching the inbox instead of the spam folder.
A properly configured email system is one of the simplest ways to improve trust, security, and communication with your customers.
#GoogleWorkspace #Microsoft365 #EmailSecurity #SPF #DKIM #DMARC #DNS #EmailDeliverability #BusinessIT #CyberSecurity
ā¢ 1d
This Windsurf AI project had all the right features but suffered from slow performance, broken components, and deployment failures. Cleaned the codebase, fixed backend integration, optimized loading speed, and delivered a scalable web application built for real users.
