#apisecurity

1. 
   aws

   How a CloudFront Custom Error Page Leaked JWTs to S3: A Case Study

   A pen-test curl found CloudFront forwarding `Authorization` headers to the S3 error-page bucket, where S3 reflected every JWT back in its XML error response. Two lines of Terraform closed it across sixteen distributions.

   NH Nedim Hadzimahmutovic Aug 13, 2026 · 12 min
2. 
   jwt

   How a JWT Audience Map Saved a CORS Mistake: A Defense-in-Depth Case Study

   On a client's API, a CORS wildcard looked like a HIGH severity finding — until we tried to actually exploit it. A second, independent JWT audience check turned a trivially exploitable bug into one that required a much harder prerequisite.

   NH Nedim Hadzimahmutovic Jul 22, 2026 · 7 min

No essays match that search.