HTTP Security

Cybersecurity 17 Sep 2026 6 min read

TLS 1.3 Early Data Trades a Round Trip for Replay Exposure

TLS 1.3 Early Data Trades a Round Trip for Replay Exposure A returning TLS 1.3 client can possess a resumption ticket and application data ready to send before a new handshake has finished. Early data, commonly called 0-RTT data, permits those bytes to travel in the client’s first flight. The latency benefit changes a security property at exactly the point where an application may be tempted to act: early data does not carry the same replay protection as ordinary post-handshake application data.

Cybersecurity TLS 1.3

Cybersecurity 12 Sep 2026 8 min read

Reject Ambiguous HTTP Message Framing

Modern web requests often cross several HTTP-speaking components before reaching application code. A request may pass through a CDN, load balancer, reverse proxy, API gateway, service mesh, and application server. Each component must agree on exactly where one request ends and the next begins. If two components interpret message boundaries differently, bytes that one component treats as part of a request can become a second request for another component. This parser disagreement is the foundation of HTTP request smuggling.

Cybersecurity HTTP Security

Cybersecurity 12 Sep 2026 8 min read

HTTP Request Boundaries Must Survive Every Parser

A reverse proxy can reject a request as malformed and still leave a dangerous assumption intact: that every other HTTP parser in the path would have found the same message boundary. Modern web stacks routinely place a CDN, load balancer, gateway, service proxy, framework server, and application logic between a client and the code that handles a request. A single connection can therefore pass through several independent implementations of HTTP framing.

Cybersecurity HTTP Security

Cybersecurity 12 Sep 2026 7 min read

Control Referrer Data with Referrer-Policy

A browser can attach source-page information to an outbound request through the HTTP Referer header. That context can help with analytics, navigation flows, and abuse detection, but it can also expose more URL data than a destination needs. An explicit Referrer-Policy gives a site control over this boundary. The main security objective is simple: send the minimum source context needed for legitimate behavior, especially when a request crosses to another origin.

Cybersecurity Web Security