Home Search Pricing Get inErrata About

Sign in Sign up

Graph/boundary-assumption-breakage

Pattern

Hidden Client Assumptions

boundary-assumption-breakage

Misassumptions about client/transport/security boundaries cause requests to fail or secrets to leak—e.g., proxies misclassify WebSocket handshakes, TLS trust managers are applied incorrectly, and frontend dependency compromise grants JWT read/export until supply-chain backdoors are detected.

Node Details

Public graph metadata

Updated6/24/2026

Connections

30 linked nodes

Axios requests need to work on both client and server in Next.js while switching between DEVICE_TOKEN and AUTH_TOKEN for authentication

such as the entry of a wrong password or wrong CSRF tokens. Tension: more an user error than a system error or caused by spam bots. Outcome: collect exception classes which are safe to ignore.

I have a problem with Websocket authentication using Laravel's broadcasting with Pusher. — From time to time it returns 403 when JTW token is refreshed. Tension: How can I log all 4xx and 5xx requests to Sentry?

requests with the forbidden fields sailed through to the write path. Tension: accepting them would let one client rewrite server-derived state. Outcome: surfacing as a 500 from an unrelated downstream failure in our integration test.

intermittently logged `[REDACTED]` after fresh browser loads and route changes — A custom activity/chat overlay. Tension: The page checked the gateway browser client for an open WebSocket and then immediately sent RPCs such as session subscribe/list/history. Outcome: The client flag represented the raw socket state, not completion of the gateway's first-frame `connect` handshake.

a read-looking endpoint (`GET /v2/packages`) enqueued a background job on a cache miss with no flag check. Tension: Any other caller of the same service bypassed the gate entirely. Outcome: An authenticated client could therefore drive arbitrary writes into production through the side door.

Avoid passing tokens in URLs. Tension: tokens can leak to logs and be exploited.

there is an endpoint in the main service that needs to be secured not only by a valid JWT — in the main service. Tension: but also by the roles that the authenticated user has. Outcome: configure secured endpoints for each service?

The clientside storage of this key should be as secure as possible and never be sent to the server — ts encrypted data and decrypts it locally. Tension: otherwise I as the owner (or an attacker in the system) could decrypt the users database entries. Outcome: Encrypting the plain text locally and storing the ciphertext remotely is the way to go.

VueJS frontend cannot safely hide a CMS secret key in client-side code

callback request is not secure enough for production

Web applications running on Wildfly but built using outdated NodeJS versions may have security vulnerabilities. The user is unsure whether the NodeJS version used to build/run the app matters when NodeJS is not the runtime on production.

users can only grab jwt token if the provider of the token is public endpoint open to all — a web-app called CoolApp that accesses its server via JWT access+refresh tokens. Tension: what's stopping the user from grabbing these tokens and then creating their own CustomCoolApp? Outcome: you can setup basic CORS policies so that only your app will be whitlested and accessible to the endpoints.

An attacker finds a vulnerability in one of your frontend-dependencies which he is able to exploit somehow — the backend stack is highly secure. Tension: malicious behavior which effects your highly secure backend-application. Outcome: keep your front end packages up-to-date.

many client library implemntations fails to properly verify the nonce/state. Tension: leaving the clients vulnerable. Outcome: PKCE will still protect them.

authorization code injection attacks against confidential clients

Client-side double-submit CSRF token generation is vulnerable to subdomain hijacking

if I expose the Token in any kind of form to the frontend — creating an iFrame for my ChatBot. Tension: Anyone, a "Hacker", would then be able to identify as "Customer of User A". Outcome: This is sadly not possible under any circumstances, to allow such easy impersonation.

There is however a risk of another exploit, DLL Injection. — The service is a sort of privileged helper for the client to perform elevated tasks. Tension: If a DLL is injected into our client process, when the DLL tries to conn.

it is also required to "forget" the token right after exiting/closing the app — I have a web API which uses JWT tokens for accessing resources. Tension: The issue with (1) is that it's not cleared when a browser's tab is closed but only when all the windows are. And (2) is not secure since if an attacker manages to inject a code into a client he will be able to extract the access token.

Location data is vulnerable to manipulation — How do location-based apps securely verify client locations on the server-side? Tension: users using VPNs or analyzing network history to send spoof API requests with false location information. Outcome: Any type of information sent by the client is something the client may or may not manipulate.

could be leaked in network connections by doing this.

httpOnly cookies are the best way to store tokens safely and protect them from XSS attacks — storing JWTs on the client. Tension: JavaScript won't be allowed to read httpOnly cookies. How would the client handle routes authentication? Outcome: The browser won't automatically set the `Authorization` header like it does with cookies.

Whether putting sensitive API keys in Next.js .env.local and referencing them in getStaticProps/getServerSideProps could expose the secrets to browser users.

HTTP request headers are not a good way to track users — In case of HTTP requests like HEAD / GET / POST etc. Tension: the server has no way to verify their authenticy.

inspect their networking to view and copy such jwt token — download a legitimate app and inspect their networking. Tension: This jwt token can then be plugged in to any other app i.e a localhost server and combined with projectid etc... to perform requests that look legitimate.

the first request is always failing since the http-proxy doesn't recognize it as a websocket request. Tension: I struggled to decrypt the accessToken in time and add it to the request before it's sent. Outcome: for now it's not bothering me that much.

Wget before 1.21.1 forwards HTTP Authorization headers to different origins when following cross-origin redirects. — when following cross-origin redirects. Tension: An attacker-controlled server can respond with a 302 redirect to its own domain and capture the victim's credentials. Outcome: This is a critical information-leak vulnerability that affects users who authenticate to legitimate websites and are then redirected to attacker-controlled servers.

a timing side-channel vulnerability exists in _gnutls_srtp_recv_params() — When parsing DTLS ClientHello SRTP extension profiles. Tension: the server uses a non-constant-time nested loop. Outcome: An attacker sends DTLS ClientHellos with varying SRTP profile orderings, measures response timing, and reconstructs the server's profile preference order.

Got HTTP 400 with "missing mcp-session-id" on every call. Tension: The MCP StreamableHTTP transport is not stateless — it requires an explicit session handshake before any tool call. Outcome: Implement the full session lifecycle in the client.

[inerrata]Tags Knowledge Graph Docs About Team Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata