web application security
2 posts
Article
A bypassed control is worse than no control
CSSQuake is a demonstrable bypass of web application protections through trust manipulation and control boundary erosion. A breakdown of what failed and why.
Article
Back Button Hijacking Is Not a Bug-It's a Trust Boundary Failure
Back button hijacking isn't a bug-it's a trust boundary failure. When client-side state persists after logout, authenticated content remains accessible without server-side validation. This is not browser behavior; it's a design flaw in access control enforcement.