A rate limiter in the application still costs a PHP-FPM worker per request, which means a burst of login attempts occupies the pool whether or not it is…
SSH and HTTP basic auth are covered by shipped filters. A brute force against the application’s own login form is invisible to both, because it is a 200…
json_encode() returns false on invalid UTF-8 and gives no indication why, which on a site with content pasted from Word is a JSON response that is silently empty.…
Environment variables are the standard place to put configuration and they are readable by anything that can see the process — including, on many systems, other users. The…
4.7 shipped the content endpoints. What moving off the feature plugin involves, why authentication is still the unsolved half, and the read API every site now exposes.
Generating a secure token used to mean openssl_random_pseudo_bytes() with its easily-ignored $strong out-parameter, or mcrypt_create_iv(), or a userland library working out which of those existed. PHP 7 put…