{
  "id": 4804285,
  "title": "Four security decisions that look like nothing and are not",
  "url": "https://urgent.news/2026/09/01/four-security-decisions-that-look-like-nothing-and-are-not",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-01T06:46:43.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/alektoreef/four-security-decisions-that-look-like-nothing-and-are-not-4144"
  },
  "original_language": "en",
  "account": "1. When implementing a login rate limit, it is crucial to count against the real TCP connection address instead of the X-Forwarded-For header. This prevents attackers from bypassing the limit by setting different values in the header for each request. While it may result in the rate limit being applied to the proxy as a whole rather than per client, the absence of protection is worse than being ineffective, as it gives a false sense of security.\n\n2. To prevent Server-Side Request Forgery (SSRF), it is essential to validate target addresses when registering them. Internal network scanners with a web interface can be created by registering malicious targets like 169.254.169.254 (cloud metadata endpoint) or loopback addresses. By validating target hosts on creation and update, services that accept user-supplied addresses and connect to them, such as webhook configurations or PDF renderers, can be secured from this common bug.\n\n3. Storing SSH host keys on first use and rejecting changed keys later is a crucial security measure. This practice, known as trust-on-first-use (TOFU) raised to an organizational level, helps detect silent man-in-the-middle (MITM) attacks. While TOFU does not catch the first connection, where the attacker may already be in position, it significantly enhances security. However, the only definitive solution is out-of-band host-key distribution, which is rarely implemented.\n\n4. Storing credentials securely by making the console write-only is essential. Users should be able to store and replace credentials without being able to retrieve them back. This approach minimizes the risk of exposing sensitive information, as a read path can be exploited by attackers holding admin sessions, finding IDORs, or with broader scoped tokens. Instead of providing a \"reveal\" button for convenience, a connectivity test using the credential without returning it can be implemented to satisfy legitimate use cases without compromising security.",
  "summary": "Disclosure: these are decisions from Tessera, which I work on. They are all small enough to copy into your own service, which is why they are worth writing up. Security feature lists are made of nouns: encryption, RBAC, SSO, audit. The things that actually decide whether a system holds up are smaller than that and never make the list. Here are four of ours, with the reasoning, including the case…",
  "key_points": [
    "Count against real TCP connection address, not X-Forwarded-For header",
    "Validate target addresses to prevent Server-Side Request Forgery",
    "Store SSH host keys on first use, reject changed keys later"
  ],
  "editors_take": "Prioritizing security over convenience and effectiveness in implementation can significantly enhance protection against common attacks, even if some measures may not be fully effective or have minor drawbacks.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}