Lesson 10. Security of mini-applications

The main thing in the lesson

In this lesson, we highlighted the following security issues:

•
Vulnerability of control, for example:
- •
  Lack of signature verification.
- •
  Errors in the implementation of access control.
- •
  Duplication vk_user_id with a different value, which allows you to pass the validation of the signature and access someone else's account.
- •
  A weak password or its absence in the admin panel of a mini-application.
- •
  Errors in business logic or trust in data transferred from the client to the server.
•
Disclosure of information, for example:
- •
  Leaks in client code.
- •
  Return hidden data to requests made with errors.
- •
  Disclose system variables in debug mode.
- •
  Disclose data in open repositories.
•

Race condition — a vulnerability that occurs when parallel requests to the server part of the application.

:::