Object injection occurs when user-supplied input is deserialized into an object within the application without proper validation or sanitization.

If the redirections are improperly handled, they often lead to open redirection attacks. However, if the number of redirection attempts is not implemented, it can cause a redirection loop, leading to an application-level denial of service and resource exhaustion attack.

As a developer, you must perform input validation at each stage even if the data is already stored in the application because avoiding this could still lead to a malicious input to trigger on later interaction (second degree), causing issues like cross-site scripting (XSS).

Publishing the undocumented APIs in an externally facing environment could allow attackers to find and use the undocumented method maliciously.

Password changes and updates after authentication are common functionalities found in most applications. While each application implements them differently, it is essential to ensure they are securely implemented.

In the first week of the series, we delve into a specific CSRF (Cross-Site Request Forgery) attack scenario and understand how you could have identified and remediated while developing your application.