I build web applications and I'm into web application security. I like to speak about secure development. My mission is to teach web developers how to build secure and fast web applications and why. (more about me, contact)

My trainings

And this is what they say about them: Originally, I've arranged Michal's training primarily for my colleagues because "of course I already know these things"... Michal has changed my mind in the first hour of the first day and continued to do so for the whole two days. Thanks to this training I finally understood some of the attack/defense concepts in full depth, and especially in the right context. — Jan Pospíšil, Senior PHP developer, Czech Radio

Public trainings

Come to my public trainings, everybody's welcome:

    Trainings in Prague (or remote) are held regularly in the middle of March, June, September, and December, in other cities irregularly.

    In-house trainings

    Any public training can also be turned into an in-house training. As an extra, I offer these in-house-only courses:

    Looking for Introduction to PHP, Classes and objects in PHP? I've handed them over to Martin Hujer. I've discontinued Web application performance, Martin Michálek runs a similar training.

    My articles

    Stealing session ids with phpinfo() and how to stop it
    April 21, 2024 (updated August 14, 2026)

    Stealing session ids from phpinfo() output has been a known technique for some time, and is used to bypass the HttpOnly attribute, which prohibits JavaScript from accessing a cookie marked as such (e.g. PHPSESSID). I just now thought of a solution that allows you to keep your phpinfo(): we'll simply censor the sensitive data, making phpinfo() lose some of its value to the attacker.

    (read more…)

    Origin, site, eTLD, eTLD+1, public suffix, PSL. What are they?
    November 20, 2023 (updated July 1, 2026)

    We call it pages, domains, servers, websites, internets and we hope the other party will understand. Maybe, maybe not, but that can always be cleared with the additional “wait, a server, don't you mean a website?” You can't just ask those questions when reading various specifications and technical documents, so they try to call things by their correct names and in a consistent manner. And they do it so well that terms like origin, site, same origin, same site, eTLD and public suffix are normally not even translated to other languages, because then nobody would understand it. And how does the attractiveness of subdomains relate to this?

    (read more…)

    Overriding HTTP response content in Chrome
    October 5, 2023

    The Chrome browser (and others like Edge) allows you to override both HTTP response headers and the response content. I've previously written about overriding the headers for testing purposes, let's see how you can override the body, or the content itself, as well. Starting with Chrome 117 (released in September 2023) it's also greatly simplified.

    (read more…)

    All articles

    My talks

    Favorites

    Upcoming talks

    I wake up and there's a new supply chain attack
    November 20, 2026, TechMeetup Ostrava 2026 (45 minutes)

    I'll happily do a talk at your event or conference, let me know!

    Talks

    Ahoj, potřeboval bych checknout bezpečnost a nasazení chatbota (pomocí AI) Czech
    October 3, 2026, LinuxDays 2026 (50 minutes)

    Kyberbezpečnost: Webová a aplikační bezpečnost Czech
    January 28, 2026, SIT Port eventy (120 minutes)

    Password Reuse Is a Dumpster Fire – We Brought a Hose
    December 2, 2025, PasswordsCon Prague 2025 (45 minutes)

    Jak básníci přicházejí o iluze a lidi o účty Czech
    October 4, 2025, LinuxDays 2025 (50 minutes)

    Pomoz password managerům pomáhat lidem Czech
    October 1, 2025, FrontKon#25 (25 minutes)

    All talks

    Me answering questions

    S Michalem Špačkem o bezpečnosti pro vývojáře i běžné smrtelníky
    October 10, 2024, Podcast ze Vzhůru dolů

    CZ Podcast 319 - O bezpečnosti, nových vlastnostech prohlížečů i Shoptetu
    May 6, 2024, CZ Podcast

    Michal Špaček: Před připojováním na veřejné Wi-Fi sítě už nevaruju
    September 5, 2022, Lupa.cz

    O temné straně UX designu
    March 1, 2022, BlueGhost Update

    Bezpečnost na internetu
    February 2, 2021, Jak na sítě

    All interviews