标签：#access

A healthtech signup flow can pass its captcha and still leave a dangerous gap: an account is banned in the profile database while an already-issued session keeps working. That is an access-control incident waiting for a clock to run out. Short answer: model a ban as an auditable profile-state transition, then revoke every session as a separate, explicit lifecycle action. Keep the short-lived access credential and its refresh capability under different risk controls, and make “this device” and “all devices” distinct operations. The incident lesson: a profile flag is not a kill switch The operational constraint is immediate shutdown. When abuse review marks a user as banned, the system must stop new work and invalidate existing access without relying on a browser logout button. I have been paged for missed jobs and duplicate deliveries; the same lesson applies here: a state change is only useful if every consumer observes it. The invariant is simple: every authentication action is a checkable, auditable, recoverable state transition. Signup protection (including captcha verification) is one transition. Session creation, verification, refresh, and revocation are four more. Treating them as one giant “auth request” makes it impossible to answer an audit question such as “which session was active after the ban?” Write the ban first, with an audit record that ties the user to the operator, reason, and request ID. Then issue the global revoke command. The ordering matters because a revoke without a durable profile state can be undone by an automatic refresh; a profile update without revocation leaves the old bearer credential alive until expiry. That sounds obvious. It is often missed. How should profile state updates trigger global session revocation? Use two explicit calls and one transaction boundary in your own service. PATCH /v1/auth/user/update/{user_id} changes the profile state. POST /v1/auth/session/revoke_all_for_user/{user_id} invalidates sessions on every devic

Acer is also introducing a new 34-inch ultrawide and several models with dynamic refresh rates.

Cloudflare has added optional OAuth scopes, letting client owners mark which permissions users may deselect at consent. The company names MCP servers as the motivating case, since agents request the union of everything they might do. Partial consent exists elsewhere, but developer control over which scopes are droppable does not. By Steef-Jan Wiggers

Sony's new ULT Tower are party speakers that chain together with Auracast.

GoPro says it's moving into AI data centers as part of a $285 million merger.

How to cancel your Whoop membership (and why you may want to).

In exchange for free stuff, devices make home connections part of a proxy network.

Sometimes the volume control on a Bluetooth device behaves unpredictably. This quick fix in your Android phone's settings is a good troubleshooting step.

There are some good reasons you might want to look for a laptop with multiple USB-C ports next time you upgrade.

Does turning off Bluetooth actually make Wi-Fi better?

Flash memory is popular for lots of good reasons, but it's not without its faults. Will the market be moving on?

Cloudflare announced Wallets, giving agents a stablecoin balance and spending controls, though only handle claiming is live and squatting complaints have already surfaced. Payments run on x402, now hosted by the Linux Foundation. The controls bound single payments, not sequences, leaving composition to the application above. By Steef-Jan Wiggers

The latest ASUS gaming monitors all feature 24.5-inch, high-refresh rate OLED panels.

The glasses, called Legato Frames, integrate the company’s patented hearing-assistance technology into the arms of eyewear frames.

BenQ's first dual-monitor desk lamp is excellent, but it'll cost you.

The ASUS ROG Gjallar is now available in the US.

We built a plugin for the GitHub Accessibility Scanner to make sure your alt text is actually accessible. Here's how it works. The post Your alt text passes automated checks. That doesn’t mean it’s any good. appeared first on The GitHub Blog .

I spent six hours trying to upgrade a non-admin user to admin, convinced I was missing some clever bypass. The gap turned out to be one field in a request body I'd already looked at twice. This is a PortSwigger lab on multi-step process access control. The setup: an admin panel with a user upgrade flow. You pick a user, hit upgrade, then confirm on a second screen before the change actually goes through. Not counting the admin login and accessing the admin panel, that's two steps. The goal was to login as wiener (my non-admin account) and upgrade it to admin without ever having admin access to begin with. Fig 1. A quick look at the admin interface in action. What I tried that didn't work I followed and wrote out the steps the admin flow actually takes, so I could inspect each step individually. Checked the change-email route for anything reusable. Tried hitting the admin and admin-roles paths directly with different HTTP methods. Added the referrer header with the value I'd seen during the legitimate admin flow. Went through the HTML and JS on every relevant page. Tried looking for where the user list was being fetched from. Tried the user-ID-in-params trick that had worked on an earlier lab. None of this brought any results and just got me more frustrated. The thing is, I was going at this problem with the assumption that in this scenario, I was a hacker with no idea of how the admin system actually worked when upgrading users. And that the lab giving me access to the admin credentials was just to hint towards any probable vulns. Why I slipped into that line of thinking, I have no idea. As I watched the hours tick by on my laptop clock, I grew increasingly aware of the painful fact that some LLM somewhere could probably one-shot this problem. That I could end my suffering by taking a knee before the mighty oracle called Claude. And you as a reader are probably wondering why I didn't submit. Well I was determined to actually learn. I had told myself going into this,

Those 200 × 200 and 400 × 400 numbers tell you where the mounting holes line up, but you still need to check the mount's weight limit and hardware.

A guide to the confusing world of USB-C fast charging.