Hacker GitHub

← All repos

OWASP/CheatSheetSeries

View on GitHub ↗ ★ 33,846 JavaScript

The OWASP Cheat Sheet Series was created to provide a concise collection of high value information on specific application security topics.

20 mentions on Hacker News by 14 people: 2 stories, 18 comments · first 2019-03-03 · latest 2025-12-22

Mentions per year 20 mentions · busiest year 2019 (11)
20082026
AllStoriesComments NewestTopOldest
  1. …We then detailed some fallbacks (eg Origin header). Full text can be viewed in the original PR https://github.com/OWASP/CheatSheetSeries/pull/1875 or https://github.com/OWASP/CheatSheetSeries/blob/7fc3e6b8fde65... If after reading that you…
    comment by nchmy · 2025-12-22 · in CSRF protection without tokens or hidden form fields
  2. …that doc is senseless and will now be modified to say that Sec-Fetch-Site is sufficient on its own. https://github.com/OWASP/CheatSheetSeries/issues/1803
    comment by nchmy · 2025-10-20 · in A modern approach to preventing CSRF in Go
  3. …The doc is wrong, and will soon be updated to say that Sec-Fetch-Site is sufficient on its own. https://github.com/OWASP/CheatSheetSeries/issues/1803
    comment by nchmy · 2025-10-20 · in A modern approach to preventing CSRF in Go
  4. The doc is wrong and will be updated soon to say that Sec-Fetch-Site is sufficient on its own. https://github.com/OWASP/CheatSheetSeries/issues/1803
    comment by nchmy · 2025-10-20 · in A modern approach to preventing CSRF in Go
  5. …on its own, rather than defense in depth. You really have no idea what you're talking about. https://github.com/OWASP/CheatSheetSeries/issues/1803
    comment by nchmy · 2025-10-20 · in A modern approach to preventing CSRF in Go
  6. Fixed: https://github.com/OWASP/CheatSheetSeries/issues/1089#issuec...
    comment by zenexer · 2023-02-22 · in OWASP Needs to Evolve
  7. They didn’t reintroduce the error; it was never completely fixed. I created an issue for it. https://github.com/OWASP/CheatSheetSeries/issues/1089
    comment by zenexer · 2023-02-18 · in OWASP Needs to Evolve
  8. The main points are 2 years old, with newer edits: https://github.com/OWASP/CheatSheetSeries/blame/master/cheat... Catch-log-new error-rethrow or catch-annotate-rethrow is (unfortunately) an important part of using Promises that isn't…
    comment by Normal_gaussian · 2021-08-12 · in NodeJS security cheat sheet
  9. https://github.com/OWASP/CheatSheetSeries/blob/a5ab44faca75d...
    comment by gnkt · 2019-08-15 · in SSL Pinning for Electron
  10. …is considered more as a defense in depth technique (e.g. in addition to #1, not as a replacement): https://github.com/OWASP/CheatSheetSeries/blob/master/cheats... ) The SameSite=Strict is also an honorable mention as an up and coming…
    comment by eranation · 2019-07-11 · in Developers don't understand CORS
  11. …to confuse readers with another concept, and because it's a really nice example to explain CORS. https://github.com/OWASP/CheatSheetSeries/blob/master/cheats... is probably one of the best documents discussing this, including the drawbacks…
    comment by tgsovlerkhgsel · 2019-07-10 · in Developers don't understand CORS
  12. You can mark a cookie as samesite: https://github.com/OWASP/CheatSheetSeries/blob/master/cheats... (as you mentioned, backwards compatibility requires that this is opt-in when the cookie is set, not opt-out)
    comment by tgsovlerkhgsel · 2019-07-10 · in Developers don't understand CORS
  13. Another option is to use a secure token ( https://github.com/OWASP/CheatSheetSeries/blob/master/cheats... ) this is a PITA but frameworks like ASP.NET have this baked in so it's not really much of a hassle in practice.
    comment by quickthrower2 · 2019-07-10 · in Developers don't understand CORS
  14. …etc). Just in case you weren't aware of it, I found this page very helpful when developing mine: https://github.com/OWASP/CheatSheetSeries/blob/master/cheats...
    comment by gtsteve · 2019-07-02 · in Ask HN: A good way to support SSO in bootstrapped SaaS?
  15. …seems pretty exhaustive. The cheatsheets directory has a lot of different vulnerability classes. https://github.com/OWASP/CheatSheetSeries/blob/master/cheats... This "Insecure Direct Object Reference" was recently combined into the "Broken…
    comment by krferriter · 2019-05-25 · in First American Financial Corp. Leaked Hundreds of Millions of Insurance Records
  16. …links in each cheat sheet. [0] https://www.schneier.com/essays/archives/2016/03/data_is_a_t... [1] https://github.com/OWASP/CheatSheetSeries [2] https://github.com/OWASP/CheatSheetSeries/blob/master/cheats... [3]…
    comment by eindiran · 2019-04-21 · in Ask HN: How do you protect sensitive data?
  17. …about the security aspect of logging, there is the OWASP Logging Cheat Sheet dedicated to this: https://github.com/OWASP/CheatSheetSeries/blob/master/cheats...
    comment by objectified · 2019-03-27 · in Application-Level Logging Best Practices
  18. …Direct Object Reference flaws also known as IDOR vulnerabilities." Then this, explaining IDOR: https://github.com/OWASP/CheatSheetSeries/blob/master/cheats... It certainly sounds like the sort of thing you could automate to a pretty big…
    comment by tyingq · 2019-03-03 · in Teen Becomes First Hacker to Earn $1M Through Bug Bounties