Tag: security
Mixed Content (HTTP on HTTPS)
When an HTTPS page loads resources (images, scripts, stylesheets) over HTTP — browsers block active mixed content and warn on passive, undermining the security of the HTTPS connection.
CWE-319
2mo ago
security intermediate
mcrypt Deprecation — Migrate to OpenSSL
PHP 5.0+
mcrypt was deprecated in PHP 7.1 and removed in PHP 7.2 — migrate all encryption to OpenSSL (openssl_encrypt) or libsodium (sodium_crypto_secretbox).
2mo ago
php intermediate
MIME Sniffing & X-Content-Type-Options
PHP 5.0+
Browsers that sniff file content to guess MIME type can execute uploaded HTML/JavaScript files as scripts — X-Content-Type-Options: nosniff prevents this.
3mo ago
security intermediate
Missing CSRF Protection
PHP 5.0+
A state-changing form or endpoint that lacks a CSRF token allows attackers to forge authenticated requests from any website the victim visits.
3mo ago
security intermediate
mime_content_type()
PHP 5.3+
Detects the actual MIME type of a file by inspecting its content — not its extension or the browser-reported type.
3mo ago
php intermediate
move_uploaded_file()
PHP 4.0+
PHP's function for safely relocating an uploaded file from the temporary directory to its final destination.
OWASP A5:2021
3mo ago
php intermediate