Skip to main content

Questions tagged [security]

For questions relating to cryptography and IT security. This can be computer, network, or database security.

Filter by
Sorted by
Tagged with
0 votes
1 answer
86 views

Resource protection for static webpages

I'm new to web developement so I'm sorry in advance because I assume this is a pretty simple question. I'm currently hosting a website on hostinger - deployed straight from my github repo. Currently, ...
serbra's user avatar
  • 9
2 votes
2 answers
99 views

How to Design a Secure Script for Conditional File Access Based on Time and API Conditions?

I want to create a secure script that grants access to files based on specific conditions. The access should be controlled by both time-based and API-based conditions. The script should only allow ...
edge selcuk's user avatar
1 vote
1 answer
201 views

Necessity of one-time codes in 2FA

Why is it that some services, when they conduct 2FA ask you to rewrite a code from an app, even if that app is part of that service's infrastructure? For example, when I log in via the web to ...
Karaal's user avatar
  • 21
3 votes
2 answers
472 views

How does "remember this computer" work?

Website multifactor authentication prompts will often include a "remember this computer" checkbox. How does this work? In order to be secure, it needs to be more than just a cookie, as a ...
Mud's user avatar
  • 476
-2 votes
2 answers
241 views

Avoiding `.env` in revision control while still being able to open source on a whim

From the 12-factors, III Config: A litmus test for whether an app has all config correctly factored out of the code is whether the codebase could be made open source at any moment, without ...
nicholaswmin's user avatar
  • 1,905
0 votes
0 answers
51 views

isolating user run scripts on docker without performance impact

Scenario: We have a application (web based), in a small part of this application a users is able to create a small python script to mutate (in memory) data. Currently all of these scripts (if it is ...
Vincent's user avatar
  • 383
0 votes
2 answers
144 views

Allow command execution in config file?

My friend and I are developing a screenshot tool for Linux where the screenshot can be saved into a clipboard by using an external tool like xclip or wl-clipboard. Since there are even more clipboard ...
TornaxO7's user avatar
  • 103
1 vote
1 answer
285 views

Should I store session id in server database?

I wanted to implement login system using flask framework. I managed to do this using sessions and set them to expire after 31 days and it works (sessions are created using server secret key, timestamp ...
Paweł Michoń's user avatar
1 vote
1 answer
115 views

Security: Send CompanyId on the http header

I have a web app which authenticates the user using an external identity provider (Microsoft Entra with MSAL library). This give us an access token to access our API. After authentication (so, we ...
zameb's user avatar
  • 121
0 votes
2 answers
176 views

How best to securely store a password for automated access (no user interaction)?

I'm facing the classic chicken/egg problem of where to store the keys to the kingdom. I'm building an application for retail distribution that will rely on receiving a cadence of regularly-issued Let'...
InteXX's user avatar
  • 245
0 votes
1 answer
141 views

Java Security, How important is the version of JDK for building vs running the Application

How important is the minor version of the Java Build SDK vs. the JDK version at runtime, is it a problem if the minor version is a bit outdated, if the run time version is still up to date? More ...
xyz1234's user avatar
  • 11
0 votes
1 answer
79 views

How to control, or moderate, files uploaded with a bug report?

Presume a desktop application presents a Problem Reporting interface as part of it's GUI, and I wish to allow users to upload files as part of that PR. One would hope this is only ever used for ...
mountainred's user avatar
2 votes
1 answer
64 views

Azure Managed Identity and Zero Trust

Azure Managed Identity provides a mean to only allow explicitly defined users/apps to access a given resource. For instance I can setup that no-one can access my database except the Managed Identities ...
Jakob Busk Sørensen's user avatar
0 votes
0 answers
59 views

Maintaining modularity while keeping (secret) configuration separate from application code

This is more a curiosity/query-for-information than anything; apologies if it's thus a little malformed: This is relevant to a useful API-querying library that can be shared across multiple teams ...
AmagicalFishy's user avatar
1 vote
2 answers
455 views

Restricting access to sensitive data in monorepo

Imagine that you have a large monorepo code base running as a monolith application. This application is backed by a database. Some of the data in the database is sensitive, so you want to restrict ...
Matt D's user avatar
  • 19
0 votes
0 answers
59 views

How to handle roles and scopes using oauth2 auth flow

I'm using python and fastapi with oauth2 flow (just for clarification as the question isn't language specific). I'm confused on how to implement scopes in an efficient and secure way. I was thinking ...
Gabriel Macus's user avatar
1 vote
1 answer
120 views

Safe Plugin Architecture for Python Web API

I am making a web application for parameterized procedural world generation. Given the computational resources involved, this application involves a server backend for generating the world with an API ...
Groger's user avatar
  • 113
1 vote
1 answer
137 views

Open source projects, SBOMs and security

I was just reading a StackOverflow question here, about extracting the version number from a node package.json file. And the simple 'read in the json and access the property in your build tool' got ...
zola25's user avatar
  • 131
1 vote
3 answers
195 views

Handling a Refactoring Project with Limited Access to Source Code

I recently finished an interview with a company as a web developer. I'm the first and only developer that is about to be hired in this company. They have a web application that was created by a ...
Saud Alghamdi's user avatar
1 vote
2 answers
90 views

Are mature dependencies less risky than state of the art ones?

There are tools like dependabot or greenkeeper for npm and others for other languages. Now at first glance they improve security by keeping open source dependencies up-to-date. But I am wondering, do ...
Phil's user avatar
  • 119
9 votes
8 answers
7k views

Is Password Hashing Bad?

In software design and security, why would it not be a good idea for users to send you their passwords and it would be a better idea to delegate: use public-key auth or logging in with one of these: ...
Daniel's user avatar
  • 517
2 votes
1 answer
124 views

EU Cyber Resilience Act - Conflicting Requirements? [closed]

As a fellow SW developer in EU, I hope that you know that there is a proposal for a new law, called Cyber Resilience Act, that will, if approved, will affect all digital products on the EU market. In ...
EmbeddedNoob's user avatar
1 vote
1 answer
168 views

Is it more secure to develop libraries in-house than using existing libraries? [closed]

I (unfortunately) work in a large German corporation, in a department where the codebase is up to 20 years old, written in C++ (actually more like C with the occasional classes, since most developers ...
hyperbole's user avatar
-1 votes
2 answers
234 views

Are Physical Firewalls mandatory

I have a Delphi software application that uses non standard port nnnnn to nnnnn+50 with the FTPS protocol TLS 1.3 Until now I was suggesting my customers that the Server Side application needs to have ...
Allan's user avatar
  • 13
1 vote
2 answers
230 views

Best way to protect action links from CSRF

An application has a multifactor login. The user logs in with its e-mail and password, and then the following screen asks for a one time password received via e-mail or generated by a mobile app. In ...
user2190492's user avatar
0 votes
0 answers
44 views

Cascading ACL to embedded objects

We have an object Root, which references many other objects. Which eventually is translated into FKs on the DB level. We came up with an ACL scheme where there's a separate permissions table with the ...
Stanislav Bashkyrtsev's user avatar
0 votes
2 answers
316 views

Keeping user provided passwords to 3rd party services safe

I have a SaaS application in which users can connect their RDBMS (postgres, mysql etc) and query data from it. I'm wondering what's the best practice to keep their connection details safe. Currently, ...
Avin Kavish's user avatar
0 votes
2 answers
380 views

Best practices for a new application to be ready for post-quantum cryptography

Suppose today I'm designing a new application that will employ asymmetric cryptography to allow users to securely exchange data with one another. As far as I can tell there are no quantum-safe ...
Peter Moore's user avatar
18 votes
9 answers
5k views

Authentication and authorisation for people with intellectual disabilities

Currently, I'm involved in a research project in which we are evaluating an existing web environment providing a safe online playground for children/adolescents with intellectual disabilities. Certain ...
KDW's user avatar
  • 349
0 votes
2 answers
222 views

How to best protect a public API from unwanted requests

I’ll try my best to explain, but for the closest context I could think of, imagine that I am building an analytics platform that allows paying users to sign up, place a tracking script on their ...
user8758206's user avatar
1 vote
1 answer
102 views

Is my security pattern correct for authenticating principal users to my microservices?

We are trying to implement an authorization and authentication service for our product. Now, we would have to cater to different kinds of IAM systems like SSO, LDAP and Basic Username+Password in ...
Anirban Das's user avatar
-1 votes
1 answer
96 views

What is the best way to authenticate a user over IVR?

I am trying to build an IVR system that requires some form of username & password/pin entry to access sensitive data. My naïve solution seemed obvious enough, until I realized that username/pass ...
Noob Saibot's user avatar
0 votes
2 answers
164 views

The best way of preventing unauthorised API use and reducing costs of declining API requests

To best explain my context, imagine that I’m creating an alternative piece of software to google analytics (since my personal project’s principle is similar). Each unique user creates an account and ...
user8758206's user avatar
45 votes
5 answers
7k views

SQL sanitizing in code with no user input

In my company's codebase, we hardcode sql queries without using an ORM. Here's an example of a query we would run: UPDATE client SET status="active" WHERE client_id=123 Since the query is ...
half of a glazier's user avatar
0 votes
1 answer
222 views

Is it secured to accept and execute user provided CURL commands

Assume you have to figure out a dynamic way where the user can provide an API call to hit in the backend for example, user to provide a webhook to call on his end server So, An idea for users to ...
Youans's user avatar
  • 461
0 votes
0 answers
55 views

SSO Application Storing a Custom Secret in the User Profile

I have an application that employs "zero knowledge" data security, where even with full backend access to our application, customer data cannot be read without knowing their individual ...
Peter Moore's user avatar
1 vote
3 answers
275 views

Are interchangeable types a security vulnerability? Are they good vectors for attack?

Suppose you are given a python API: def onArgumentReceived(x): doWhatever(x) # expects a unicode string I am not a security expert by any stretch of the imagination, however on the face of this, ...
Anon's user avatar
  • 3,613
1 vote
1 answer
304 views

How to manage autorization for internal service to service communication in a microservice architecture?

At deployment time, I register my microservices in the following way: They register themselves in Keycloak to have an identity as a confidential client; Then they call an endpoint on a dedicated ...
Dypso's user avatar
  • 231
0 votes
1 answer
1k views

Can I use a session cookie for API authentication?

I want to build a web application with a Single Page Application as the front end and an API as the back end. The front-end SPA will read and write data to the API. The SPA and the API will be hosted ...
Damien Monni's user avatar
1 vote
2 answers
158 views

How can I enable user data sovereignty in a B2B SaaS application?

We develop a SaaS solution that processes customer ERP data and provides analyses from it in a front-end. The software is a standard solution and should require as little customization as possible for ...
Dennis's user avatar
  • 13
0 votes
3 answers
160 views

Should security and data validation be implemented within database or application?

I am building a simple web app where one set of users have varying admin privileges who can write to database and the other set can only view data. I am used to securing APIs with JWT or session ...
Hashir's user avatar
  • 1
-2 votes
1 answer
233 views

Security implications of storing credentials in a .env file

I understand that credential leakage occurs reasonably often due to people forgetting to .gitignore a .env file I'm building an application in VueJS and right now I'm storing some S3 credentials as ...
Pierre Baudin's user avatar
1 vote
1 answer
701 views

microservice file upload/download central vs distributed api

In microservice architecture, let's say I have 4 services that will need file upload/download feature, I have two options for this: I can create another new service(5th) to expose an file upload/...
danny's user avatar
  • 119
-3 votes
1 answer
72 views

HTML Playground [closed]

I'm creating a service for creating web tools. The tool is a generated web page with some JS engine. The user can interact with the JS engine through the user interface. The user interface can be ...
christo's user avatar
  • 105
0 votes
2 answers
66 views

Personal AES keys storage idea not working reason

I went through different ideas about storing AES key for encrypting database columns, I learnt that there are the possible solutions: put the key in the database find a Key Management Service to help ...
desmond ng's user avatar
1 vote
3 answers
3k views

Designing APIs that don't expose database primary keys

People say "don't expose primary keys from the database in your API" because its a major security leak, so I'm trying to come up with a way for: RESTful HTTP requests to reference server-...
hotmeatballsoup's user avatar
0 votes
2 answers
52 views

At which points in the process/stack is Cloud data not encrypted - Cloud Security

Assume an application developed in a PaaS public cloud environment. The application stores and processes some kind of sensitive data. Encryption-at-rest seems clearly described already, and the option ...
MrSpence's user avatar
0 votes
1 answer
187 views

Should an access token really be cryptographically signed?

In a web app I'm writing, a singed-in user is recognized by their cookie containing a session identifier. That session id has sixty-four bits of entropy, so I believe brute-force attacks are ...
Schmo's user avatar
  • 113
2 votes
4 answers
206 views

Which approach can be used to verify that information has not been manipulated after it has been recorded?

I am looking for an approach to verify that some information has not been modified after a certain point in time. Let's assume a data provider records a data set at time X and provides it to a data ...
Braveness's user avatar
2 votes
3 answers
619 views

How do you reduce security risks when using NPM packages in commercial Web development?

This is a question for software engineers who are tasked with managing the development cycle for a Web application using NPM packages for deployment on a customer's Intranet or the Internet. This is ...
J.R.'s user avatar
  • 95

1
2 3 4 5
19