May 12, 2007 - 15:47 CEST There has been a lot of writing about Cross-site request forgeries (XSRF/CSRF) lately. I've read numerous articles on how this could be used to capture home routers or create false online-banking transactions. In this post I'll discuss some techniques for protecting your website against XSRF.
[...]

May 11, 2007 - 09:02 CEST Just read Kyan's post about Opera 9.5 including support for HttpOnly cookies. Nice.[...]

April 25, 2007 - 09:00 CEST If you haven't allready read "Innocent Code" by Sverre H. Huseby, you should really look into it. It's not just a book for developers with a special interest in security. I actually think you should consider reading this book mandatory before developing even the smallest web application.
[...]

April 12, 2007 - 09:11 CEST Just read Gnucitizen's article about exploiting firebug using javascript. This technique has been dubbed Cross-zone scripting, and is somewhat similar to XSS. Scary stuff.[...]

March 31, 2007 - 11:58 CEST I'm just back from the security conference Blackhat Amsterdam 2007. It was a great trip and I met a lot of interesting people.
[...]

March 16, 2007 - 10:15 CET I was looking through my log and found a referer entry where somone had searched google with the search term "javascript+validation+to+avoid+SQL+injection". It seems some developers still don't understand that trying to lock up an application on the client side using javascript is impossible. It is like trying to avoid burglaries to your home by locking the doors to the homes of every thief around.
[...]

March 9, 2007 - 17:23 CET I just read an article on cookies in regular ASP, which explains some of the concerns related to session cookies. In this post I'll explain how this works in ASP.NET.
[...]

March 5, 2007 - 16:14 CET A colleague of mine pointed me to the Spry Framework from Adobe. It's an elegant AJAX framework with a template/taglibs-like syntax. The framework basically consists of four javascript files. These files contains classes that makes implementing Ajax really simple. You can dynamically load data or add effects to your site.
[...]

March 1, 2007 - 13:03 CET Microsoft has a good explanation on how to set passwords using LDP here: http://technet2.microsoft.com/WindowsServer/en/library/a0c11d1d-bf96-4ad3-8066-1b36d19c11aa1033.mspx?mfr=true.
[...]

February 23, 2007 - 08:57 CET Dmitry Chan pointed me to the new release of the OWASP Testing Guide. Interesting stuff.[...]