"API keys are foundational elements for authentication, but relying solely on them is inherently a risky proposal.

Firstly, there’s the reality that API keys are not securely designed — they were never meant to be used as the sole form of authentication, and as such, they aren’t really built for the task. These keys can often be easily stolen, leaked, or, in some cases (especially if generated incrementally), outright guessed. An API key is suitable for tracking usage but is poor for security.

There is also the additional reality that keys in their default state lack some critical functionality. There’s not a lot of verification built-in for identity management, and what does exist offers very little in the way of granular access control.

Ultimately, solely relying on API keys is a mistake common with novice developers but frighteningly common even in advanced products.

Best Practices
Instead of relying heavily on API keys as a sole mechanism, combine those keys with additional approaches such as OAuth 2.0 or mTLS. Implement rigorous expiration and rotation policies to ensure that keys which are made public are only useful for a short amount of time. Consider more advanced approaches, such as IP whitelisting or device fingerprinting, to add another layer of security atop the API key process."

https://nordicapis.com/9-signs-youre-doing-api-security-wrong/

"It is now time to fix it for good. A new solution has been proposed: partitioning visited link history. This approach fundamentally changes how browsers store and expose visited link data. Instead of maintaining a global list, web browsers will store visited links with a triple-key partition:

- Link URL. The destination of the visited link.
- Top-Level Site. The domain of the main browsing context.
- Frame Origin. The origin of the frame rendering the link.

A link is only styled as :visited if it was visited from the same top-level site and frame origin (...) This approach guarantees isolation and works well with the web's same-origin policy. The system records only navigations initiated by link clicks or scripts—excluding direct address bar entries or bookmark navigations.

Key benefits of this model include: strong protection against cross-site history leaks, solving for good of many known side-channel attacks, support for meaningful styling within trusted, same-context domains, conforming to established web privacy principles and data protection regulations.

This feature is already implemented in Chrome (v132, behind a #partition-visited-link-database-with-self-links flag). I am confident that in 2025 we are going to have this privacy headache solved once and for all."

https://blog.lukaszolejnik.com/fixing-web-browser-history-leaks/

Master Modern Web App Security at OWASP Global AppSec EU 2025 in Barcelona!

2-Day Training | May 27-28, 2025
Level: Intermediate | Trainer: Abraham Aranguren

Take a 100% hands-on deep dive into the OWASP Security Testing Guide and Application Security Verification Standard (ASVS) in this action-packed course.

Register now
https://owasp.glueup.com/event/123983/register/

BREAKING NEWS: Swiss passport design REVEALED! Oops, just kidding—turns out it’s a secret so secure, even you're forbidden from seeing it. If only Swiss #neutrality extended to web access too.
https://kottke.org/25/03/the-design-of-the-new-swiss-passport #SwissPassportDesign #SecretAccess #WebSecurity #HackerNews #ngated

Critical Next.js Vulnerability Exposes Web Apps to Authorization Bypass Attacks

A newly discovered vulnerability in Next.js, a widely-used React framework, allows attackers to bypass critical authorization checks, putting millions of web applications at risk. Developers are urged...

https://news.lavx.hu/article/critical-next-js-vulnerability-exposes-web-apps-to-authorization-bypass-attacks

Unveiling a Critical Vulnerability in Next.js Middleware: A Deep Dive

A recent security discovery has exposed a critical vulnerability in Next.js middleware, affecting all versions from 11.1.4 onwards. This flaw allows attackers to bypass authentication and authorizatio...

https://news.lavx.hu/article/unveiling-a-critical-vulnerability-in-next-js-middleware-a-deep-dive

Introducing Powxy: A New Defense Against Scraper Bots with SHA-256 Proof-of-Work

In an age where data scraping is rampant, Powxy emerges as a robust solution leveraging SHA-256 proof-of-work challenges to safeguard upstream resources. With a focus on simplicity and efficiency, thi...

https://news.lavx.hu/article/introducing-powxy-a-new-defense-against-scraper-bots-with-sha-256-proof-of-work

Oh no! The sky is falling! The unauthenticated web is apparently under threat from those terrifying AI scrapers that just can't resist causing havoc. Clearly, we should all panic and throw our websites into the arms of corporate gatekeepers.
https://sethmlarson.dev/i-fear-for-the-unauthenticated-web #AIThreats #WebSecurity #CorporateGatekeepers #PanicMode #HackerNews #ngated

I Fear for the Unauthenticated Web

https://sethmlarson.dev/i-fear-for-the-unauthenticated-web

New talk at Dutch PHP Conference!

Manual code reviews don’t catch everything—but static analysis tools can help detect security vulnerabilities before they become a problem.

Join Nic Wortel at DPC 2025 for:
"Finding Security Vulnerabilities with Static Analysis"

Check the schedule: https://phpconference.nl/session/finding-security-vulnerabilities-with-static-analysis/

New talk at Dutch PHP Conference!

Security & UI/UX are often seen as opposites, but they can work together like a pirate ship & its sails!

Join Mike van der Bijl at DPC 2025 for:
"Sailing the Waters using UI/UX Reinforced by Security"

https://phpconference.nl/session/sailing-the-waters-using-ui-ux-reinforced-by-security/

Node.js Security in 2025: Best Practices and Threat Mitigation

https://bloggingaadd.com/nodejs-security-in-2025-best-practices-and-threat-mitigation

Learn the best Node.js security practices for 2025 to protect your applications from evolving threats. Explore key strategies for threat mitigation, data protection, and secure coding.

#NodeJS
#CyberSecurity
#WebSecurity
#SecureCoding
#BackendDevelopment
#APISecurity
#TechTrends2025
#DataProtection
#SoftwareSecurity
#JavaScript
#SecureApps
#ThreatMitigation

Chrome's Manifest V2 Extension Phase-Out: A New Era for Browser Extensions

Google's transition away from Manifest V2 extensions in Chrome marks a pivotal shift in web development and security. As the tech giant moves towards Manifest V3, developers face both challenges and o...

https://news.lavx.hu/article/chrome-s-manifest-v2-extension-phase-out-a-new-era-for-browser-extensions

Angular Security: 5 Practices Every Developer Should Know

https://www.tuvoc.com/blog/angular-security-5-practices-every-developer-should-know/

Enhance your Angular applications with top security practices every developer should know. Learn how to prevent common vulnerabilities and protect your app from threats.

#Angular
#WebSecurity
#CyberSecurity
#AngularBestPractices
#SecureCoding
#FrontendSecurity
#JavaScript
#WebDevelopment
#AppSecurity
#DataProtection
#SecurityBestPractices
#CodingTips
#SecureWebApps
#AngularDevelopment
#DevSecOps

Certificate Transparency in Firefox: A Big Step for Web Security — https://blog.transparency.dev/ct-in-firefox
#HackerNews #CertificateTransparency #Firefox #WebSecurity #CyberSecurity #TechNews

Mastering Nginx: Essential Configurations for Secure and Efficient Static Site Hosting

As the demand for fast and secure web hosting grows, Nginx stands out as a powerful solution for developers. This article delves into the essential configurations that enhance performance, security, a...

https://news.lavx.hu/article/mastering-nginx-essential-configurations-for-secure-and-efficient-static-site-hosting

Fingerprinting: Critics say Google rules put profits over privacy

Changes which come in on Sunday permit so-called "fingerprinting", which allows online advertisers to collect more data about users including their IP addresses and information about their devices.

https://www.bbc.com/news/articles/cm21g0052dno

Fortifying Your Cloudflare Pages: Essential Security Headers for Developers

As web applications become increasingly targeted by cyber threats, understanding and implementing security headers is vital. This article explores how to configure essential HTTP headers within Cloudf...

https://news.lavx.hu/article/fortifying-your-cloudflare-pages-essential-security-headers-for-developers

Our 2nd Keynote is here!

We're excited to have Frederik Braun @freddy (Mozilla) at #MADWeb '25!

With Carrots & Sticks: Can the Browser Handle Web Security?

Join us in San Diego to attend this session!

Full program: https://madweb.work/#program