#express

1. 
   aws

   Closing the Rate-Limit Bypass: A CloudFront + ALB Case Study

   How we closed an `X-Forwarded-For` spoofing bypass on an AWS WAF rate-limit rule — CloudFront custom secret header, ALB origin verification, and a composite-key rate-based rule that actually counts real clients.

   NH Nedim Hadzimahmutovic Sep 14, 2026 · 10 min
2. 
   express

   Replacing a Wildcard CORS Policy: An Express Allowlist Case Study

   How we replaced a permissive Express `cors` regex with a strict allowlist — escaped-dot origin matching, `Vary: Origin` on every response, and no more CWE-942 finding on the pen-test report.

   NH Nedim Hadzimahmutovic Aug 31, 2026 · 8 min
3. 
   jwt

   How a JWT Audience Map Saved a CORS Mistake: A Defense-in-Depth Case Study

   On a client's API, a CORS wildcard looked like a HIGH severity finding — until we tried to actually exploit it. A second, independent JWT audience check turned a trivially exploitable bug into one that required a much harder prerequisite.

   NH Nedim Hadzimahmutovic Jul 22, 2026 · 7 min

No essays match that search.