AWS shipped four condition keys for DynamoDB and did not evaluate them at runtime. Your policy sat there, looked excellent in code, and did nothing.
A JWT That Trusted the Client: How One Shortcut Became Full Admin Access
A penetration test where a JWT carried the user’s role in its payload and the server trusted it. Changing one field – and an allowed alg:none – turned an ordinary user into an administrator.
A Valid Token Is Not a Permission: The OAuth Scope Nobody Checked
The Authorization Code flow was textbook. Then the server accepted any valid access token on an admin endpoint, whatever scope it carried – and I created an administrator.
“It’s GraphQL, It’s Typed, It’s Safe” – One Introspection Query Later
Introspection returned the whole schema. One mutation set isAdmin=true. The UI hid the field; the API never checked it.
They Batched Eight API Calls Into One. I Chained Three of Them Past Authorization.
A performance optimisation – one endpoint instead of eight calls. Every command was authorised on its own. Nobody had asked what happens when they run in the same request, against the same session object.
Sandwich Attacks: From Reset Password to Account Takeover
Once Upon a Password Reset… You’ve just forgotten your password for a website. No big deal, you click “Forgot Password,” they send you a link, and you reset it. At the time the feature was designed, it was decided that this reset link would include a UUID token. The reasoning seemed sound—since UUIDs are unique, […]