What is Open Redirect?
A redirect endpoint that forwards users to any attacker-supplied URL, weaponized in phishing. Allowlists of destinations or signed redirect parameters keep navigation features from becoming launchpads.
Related terms
OAuth 2.0 Authorization Code Flow
The standard delegation flow where users approve access on the provider and the app exchanges a short-lived code for tokens server-side. BYOB-managed Google sign-in hides this handshake from project developers entirely.
Cross-Site Request Forgery (CSRF)
An attack that tricks a logged-in browser into submitting unwanted state-changing requests to a trusted site. SameSite cookies, anti-CSRF tokens, and origin checks break the forgery chain.
Webhook Timestamp Tolerance
The maximum acceptable age of a signed webhook before rejection, typically measured in minutes. Tolerance windows block replay attacks while forgiving normal delivery delays and clock skew.
SQL Injection
An attack that smuggles database commands through unsanitized input into application queries. Parameterized statements and least-privilege database roles keep hostile input as data, never executable code.
CSP Directives
The individual rules inside a Content Security Policy, such as script-src, object-src, and frame-ancestors. Each directive narrows one resource class, so auditing means reviewing directives one by one.
HTTP Strict Transport Security (HSTS)
A response header that obliges browsers to use HTTPS only for a domain, blocking protocol-downgrade attacks. BYOB’s Traefik edge already redirects port 80 to 443, and HSTS pins that behavior client-side.