what happens to a request inside nginx and Apache
How nginx and Apache select a site, process the path and forward a request to the application, and what you can test from the outside.
Pingiskok.
Bugs, vulnerabilities and security research. Web2, Web3, Bug Bounty
$
cat /etc/motd
Latest Articles
where HTTP actually breaks
How proxies and applications interpret the same request differently: body boundaries, paths, forwarding headers and cache keys.
Post-Quantum JWT and the Future of Tokens
The series finale. Shor's algorithm breaks every asymmetric JWT algorithm. ML-DSA signatures at 2.4 KB don't fit in a cookie. SD-JWT for selective disclosure. Harvest Now, Decrypt Later — why migrating JWE to post-quantum cryptography is needed now.
RFC 8725 - the checklist nobody reads
RFC 8725 — fifteen JWT security rules from the standard's authors. For each — which attack from the series it prevents, which CVEs exist, and why ~65% of applications don't check aud. Plus three new rules from the 2026 bis update.
What Instead of JWT - PASETO, Macaroons, Opaque Tokens, and Server-Side Sessions
JWT isn't perfect — 70+ CVEs over ten years. We break down the alternatives: PASETO without the alg field, Macaroons with unique attenuation, opaque tokens with instant revocation, Google/Netflix server-side sessions. For each — what to break on a pentest.