https://vvnblog.com/en/tags/web-security/Recent content in Web Security on Vivian's BlogHugo -- gohugo.ioenCopyright © 2026 Vivian All Rights Reserved.Fri, 19 Jul 2024 00:00:00 +0000https://vvnblog.com/en/posts/graphql-leak-info/Fri, 19 Jul 2024 00:00:00 +0000https://vvnblog.com/en/posts/graphql-leak-info/One open Introspection Query let me list the entire GraphQL schema. A real pentest case of a common but costly setup mistake.https://vvnblog.com/en/posts/cookie/Thu, 23 May 2024 00:00:00 +0000https://vvnblog.com/en/posts/cookie/One badly set cookie is enough for an attacker to pretend to be you. Meet the three lines of defense (Secure, HttpOnly, SameSite) and how to turn them on.https://vvnblog.com/en/posts/jwt/Thu, 11 Apr 2024 00:00:00 +0000https://vvnblog.com/en/posts/jwt/How does one string split by dots hold up the login for modern websites? Breaking down the three parts of a JWT, and the traps to avoid.