Research
TL;DR: If a public client respects the RFC 7009 spec and does not authenticate the revocation request, then Doorkeeper does not actually revoke the access token. Upgrade to versions 4.4.0, 5.0.0.rc2 or later The Problem Any OAuth application that uses public/non-confidential authentication
Security
Software Description Doorkeeper is a Ruby gem that makes it easy to introduce OAuth 2 provider functionality to a Rails or Grape application. Depending on how a developer uses the gem, they may allow any registered user to create OAuth client applications in their software. CVSSv3 Base Score: 7.6
Security
TL;DR: Once a user successfully provides a valid OTP, that OTP can be replayed for the duration of the timestep. Upgrade to version 2.0.0 or higher. The Problem Devise-Two-Factor implements RFC 6238 which defines a way to provide what is commonly known as Two-Factor
Security
TL;DR: If a public client respects the RFC 7009 spec and does not authenticate the revocation request, then Doorkeeper does not actually revoke the access token. Upgrade to version 4.1.1, 3.1.1, or 2.2.3 The Problem Doorkeeper implements OAuth 2.0 access & refresh
Security
If this post is greek to you, take a look at my Ember CLI and Content Security Policy (CSP) blog post. Earlier this month, I had the opportunity to speak at the Toronto EmberJS Meetup, a monthly meeting at Pharmacy (pictured above), about Ember CLI and Content Security Policy. I
Security
As of Ember CLI v0.0.47 there is now built-in support for Content Security Policy in our apps! WTF is a CSP? It's a beautiful defence against XSS attacks. You simply send a HTTP header in server your response. A example policy would be: Content-Security-
Security
I had the opportunity to help my employer, FreshBooks, implement a responsible disclosure policy. As it turns out, it's very difficult to offer a PGP key while maintaining trust, security, and convenience. In this post I hope to outline the struggles, the roadblocks, and practical strategy surrounding PGP