Security Researcher Finds Origin Bypass Flaw in OAuth SDK Used by Web3 Project

·1 views

A security researcher discovered a critical vulnerability in an OAuth SDK during a review of a web3 application that used Google Sign-In. The SDK's postMessage listener accepted incoming messages from any origin without validating the event.origin field, meaning malicious pages could inject forged authentication data. Compounding the risk, the SDK generated OAuth request IDs using a simple incrementing counter rather than a cryptographically secure random value, making IDs trivially predictable. An attacker with another tab open could exploit both flaws together — predicting the next request ID and sending a spoofed message via window.opener.postMessage to hijack the authentication flow. The researcher responsibly disclosed the findings, highlighting how two individually subtle oversights can combine into a serious authentication bypass.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developers debate how much backend logic belongs inside Next.js vs Node.js

A developer building applications with Next.js has raised a widely discussed architectural question: how much backend logic should remain within Next.js before moving to a dedicated Node.js service. Next.js offers built-in backend capabilities such as Server Components, Route Handlers, and middleware, making it convenient for smaller applications to consolidate frontend and backend in one project. However, as applications scale, concerns around authentication, background processing, real-time communication, and independent scaling make a separate Node.js service increasingly attractive. The developer suggests the more useful question is not whether Next.js can serve as a backend, but which responsibilities will become problematic if kept inside it. They are seeking input from developers who have run both architectures in production, particularly those who have migrated away from a Next.js-only setup due to real-world scaling challenges.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How a pnpm Workspace Flag Fixed Prisma Client Resolution in a Monorepo

A developer working on the RAHB project encountered a Prisma Client resolution error while running prisma generate inside a pnpm monorepo setup using NestJS and Next.js. Although Prisma and @prisma/client were both installed at version 6.19.3, the API workspace could not correctly locate the client during code generation. The root cause was that dependencies had not been explicitly installed at the workspace root level, which pnpm requires when sharing packages across multiple workspace packages. The fix involved re-adding both prisma and @prisma/client using the -w flag to target the workspace root, followed by a fresh pnpm install. After this change, the prisma generate command ran successfully and produced the expected Prisma Client output.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Engineer Warns of API Inconsistencies After Prod Env Broke Working Integration

A software engineer shared a cautionary account of integrating a third-party API from a large, established company that passed all testing and received UAT sign-off. When the team moved to production, the API behaved entirely differently, with inconsistent response keys compared to the test environment. This forced the team to rework over 50% of their integration, despite having made no errors on their end. The incident highlighted a critical principle: test environments must closely mirror production, otherwise testing loses its validity. The engineer also flagged internal inconsistencies within the API itself, such as the same data being returned under different key names across endpoints.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Builds Background AI Lead Classifier That Never Delays Form Submissions

A SaaS developer built an AI classification layer for their form tool that categorizes incoming submissions by type and priority without affecting submission speed. The system uses Google's Gemini Flash model as a background job, meaning the AI runs only after the form response is already delivered to the visitor. This architecture ensures that LLM failures, timeouts, or rate limits cannot result in lost leads, since submissions are saved before classification begins. Each submission receives an auto-generated category, priority level, and summary, which are then surfaced in both the dashboard and notification emails. The approach was driven by real production constraints including latency, reliability, cost at scale, and the need for structured, parseable AI output.

0 comments Read more at DEV Community