Security

HTTP gets a sixth verb, and every allowlist you own was written for five

RFC 10008 defines QUERY - a GET with a body, safe, idempotent and cacheable. Handling in the wild already disagrees: nginx and Django reject it, Caddy, Traefik and FastAPI pass it through.

Dev News Daily19 Sep2 min read

Security

Four CVEs in pgAdmin let a request choose which database server your password goes to

pgAdmin 4 v9.18 closes an authentication bypass and two connection-string injections that redirect the connection, and the exported password, to a host of the caller's choosing.

Dev News Daily17 Sep3 min read