Security Controls

A control that reverts to a default still reports success

Security libraries take their policy as an options object, which makes them the sharpest case for everything on this site. An option key the library cannot read is indistinguishable from one you never supplied, so the guard does not fail - it falls back, and the fallback is weaker than the policy it replaced. In the measured articles this produced accepted off-host redirects, re-admitted HTML, multiplied password attempts and a permission where a prohibition had been.

Read the Failure Modes Try Online Obfuscator

Why This Category

Nothing throws

In this group the correct run and the broken run produce the same log line. The difference is in what was allowed.

RevertedThe library uses its own default. Weaker, and reported as a normal run.

InvertedA lost prohibition flag turns a rule into its opposite and logs an approval.

BypassedA strict check behind an enabling flag is never reached once the flag is lost.

Design Rules

Three choices that decide the direction

All three are free at design time and none of them is specific to obfuscation - a version bump, a partial response or a hand-written mock produces the same missing value.

Write the flag as a permission

allowed, valid, ok. A missing permission is falsy, so the answer is no. A missing prohibition - denied, blocked - permits.

Prefer an allowlist

An allowlist fails closed when an entry it does not know arrives. A denylist fails open on everything nobody thought of. The exception is when the option carrying the list is what goes missing - then both fail open.

Do not let the alarm share the name

If your detector reads the same property the payload writes, one rename removes the guard and the alarm together. Keep the check where the transformation cannot reach it.

The Articles

Grouped by what reads the name

Each article names the party that writes each field, runs the correct build first, then compares the protected build against it. Where a result is reported, it was executed rather than inferred.

Authentication, sessions and tokens

Cost parameters, signing options and claim names. A token is authored by a server you do not build with, so its claim names are a contract your build does not own.

Request-level guards

The clearest measurements of the revert shape: in each of these the check kept running and kept reporting itself installed while enforcing the library default instead of your policy.

Authorisation and policy

Rules expressed as data. Renaming rewrites names in code and never the text a rule is written in, so a policy document keeps matching nothing while the engine reports that it ran.

Integrity, signing and evidence

Where protection helps rather than hurts, and where the hash has to be taken over the artefact you actually ship.

Frequently Asked

Common questions about this surface

Does obfuscation weaken my security controls?

Obfuscation on its own did not, in every article in this group - the base measurement is clean. Member renaming can, because these libraries read their policy out of option objects and an unreadable key reverts to a default.

Does obfuscation break CSRF protection?

Not by itself. The risk is renaming the option names the middleware reads, or the field name the token arrives under - the request body is written by a form or a client that never saw your rename.

Can obfuscation break JWT validation?

The claim names inside a token are chosen by the issuer and arrive as base64 JSON. Renaming your reads of them without reserving those names means your code asks for a claim that is not there.

Should security-critical code be renamed at all?

The safe answer is to rename only members you own on both sides, using a naming convention. Anything a library reads, a server writes, or a policy document names should be reserved.

Would a failing control be obvious in testing?

Not reliably. The failures in this group produce successful requests and normal log lines; several also disable the telemetry that would have reported them. Assert on the decision, not on whether the check ran.

Does obfuscation help with compliance or trade-secret claims?

It is evidence of a reasonable measure to keep information secret, which is one element of a trade-secret claim. It is not a legal control by itself - the article in this group sets out what it does and does not support.

Start with the shapes, not the list

These controls fail in the shapes catalogued on one page. Read that first if you are deciding what to reserve.

Six Failure Modes › Protect Members Security and Trust Runtime Defense