Hot answers tagged appsec
No, authentication is not a sufficient compensating control for lack of input validity checking. You can't always usually ever trust input from users and and other systems (and I recommend not trusting input from your own system, as well). As an example, I've had roughly 5 instances in the last three months where a trusted user's system acted as an ...
Only top voted, non community-wiki answers of a minimum length are eligible