#web-security

Web Development

Mapping a web application's attack surface: every entry point and the control it needs

Samuel Osei · Mar 29, 2026 · 7 min read

Before you can secure a web application you need a list of everything an attacker can touch. A practical method to map inputs, authentication, sessions, file handling, APIs, admin paths and third parties, with the control each area needs.

Web Development Bug Report

Logged in on app.example.com but the API on api.example.com saw no session: cookie Domain rules

Hannah Okafor · Aug 27, 2025 · 7 min read

After splitting our frontend and API onto separate subdomains, users logged in and were then treated as anonymous by every API call. The session cookie was host-only and fetch did not send credentials. How cookie scoping works across subdomains, the CORS settings that go with it, and the trade-offs.