51–52 of 52 posts
I think everyone need to remember CORS is a browser-only protection and anything you expose via CORS protected endpoint in reallity has no protection at all. Try cURL reaching any endpoint protected by CORS and you'll see what I mean. Also browsers automatic sending cookie enable many of these CSRF, consider JWT. Amazing how PHP is still bitting developers.
These seem to have been "technical" bugs, mostly in the client-server communication of the self-service websites. But hosting management also has a whole lot of potential for logical errors. I work at a B2B ISP that is also a managed service provider, and every now and then somebody calls for more self-service. I'm not against it, but it's full of landmines. It starts with such simple things as account creation. We a…
Curious, shouldn't you have moved over to IPv6 at this point?
One customer has one or two whole /8 blocks of public IPs that they use even for internal systems in our data centers. Others are IPv6 on the inside and IPv4 public facing. Some are big layer 2 setups (which we internally route through IPv6).