Questions tagged [security]
For questions relating to cryptography and IT security. This can be computer, network, or database security.
0
votes
1answer
34 views
rest service with digitally signed parameters
I'd like to build a rest service that will accept objects that has digital signature. This service has to support both xml and json data serialization formats. I'd like to use .Net core framework to ...
0
votes
0answers
45 views
Prevent token sharing: chained single-use tokens VS a designated invalidation feature
Situation:
A Client is requesting a resource from a Host multiple times, usually with minutes or hours between requests.
The Client has a signed, verifiable token, which we'll call a Receipt, that ...
4
votes
1answer
126 views
Architecture to lock account to mobile device
I'm currently creating a mobile app and have the following issue.
I am required to only allow the user to login from a device that is registered to the users account. A user can have up to X number of ...
0
votes
0answers
20 views
Save user credentials for use with multiple third-party websites
I've seen a few similar questions but nothing to address this exact issue... I'd like to have a mobile app that allows users to input username/password once and then be automatically logged in with ...
1
vote
0answers
106 views
How to store relational data belonging to different client customers?
My users will be businesses with a small number of accounts each: e.g. Business #1 with 3 users, Business #2 with 5 users, etc.
I am trying to determine the best way to organise the relation (on ...
0
votes
0answers
56 views
What's the best way to control distribution/usage of proprietary, internal software?
I was tasked with writing software for my company. As I am now writing a third program (with many more coming), what's the best way to control the distribution/usage of our software?
The software I'...
1
vote
1answer
65 views
How to store private ssh keys for my application?
I 've a pair of private and public ssh keys, which I'm using in encrypting and decrypting my JWT.
So I'm creating and signing my JWT with my private key and shared the public key with the client who ...
0
votes
0answers
14 views
W3C Reporting API - Mitigate spam/forged reports
I'm looking into the W3C Reporting API, which enables websites to instruct the client (browser) to send reports about: browser crashes, network errors, browser interventions etc. ouside the JS ...
0
votes
2answers
128 views
How do companies store private keys offline but still sign code with them?
I've heard that companies store their private keys offline "in a safe that will never be opened" and stuff like that (the context for this is a console developer like Microsoft keeping the Xbox ...
0
votes
1answer
32 views
How to prevent angular 2 client from accessing privileged fields
I'm learning angular and have been reading about various backend solutions like direct db access, REST, and graphql. One thing I haven't seen addressed anywhere yet is how do you protect privileged ...
0
votes
1answer
51 views
Designing anonymous registration website
I am developing a website where customers can register products they bought in order to receive a benefit in the form of e.g. a cashback, a discount or promotional goods. In the future, we also plan ...
0
votes
0answers
7 views
Open ID Connect Session Management Access/Refresh Token vs Session iFrame
We have a web app in which we allow users to log into the app using any Open ID provider(e.g. Okta, Google, Facebook etc.). We want to implement the correct Open ID Connect prescribed methodology/...
2
votes
1answer
106 views
Is it possible to create once loadable files?
I know very little about encryption, so I figured I'd ask the internet if it's possible to do the following (and if so, what kind of algorithm should I be looking at):
Write some code that saves data ...
1
vote
2answers
39 views
JDBC Connection Url Logging - Security Risk
In one of the existing batch process codebase, I can see a practice of JDBC Connection String is getting logged and also persisted. Logging or Persisting a JDBC Connection String alone may not be a ...
0
votes
0answers
28 views
How to restrict API endpoints which are deployed in AWS Application Load Balancer?
I created one webapi application which includes few modules like account, user etc and overall includes 10 or more endpoints.
I deployed this in EC2 instances and configured in application load ...
0
votes
1answer
75 views
Is it a bad thing to delegate a callout to an external system, given that my current one can't do it?
Custom code written for the Salesforce platform is incapable of making a PATCH request to an external server (PUT and POST are okay though), and I need to make a PATCH request to an external service (...
0
votes
4answers
54 views
Extent of Administrator Capabilities: HR and Design Logistics?
So I am developing an employee management application on behalf of a company and am concerned about the extent of rights and capabilities that are to be bestowed upon registered administrator accounts....
3
votes
1answer
209 views
Does it make sense to authenticate a method that exposes non-sensitive data
We're developing an Angular application that consumes a web method exposing some information that is not sensitive, just bus seat promotions; the user enters where he wants to go and when and he will ...
8
votes
1answer
339 views
Securely sandboxing user scripts in a C++ program
I've been working on a personal project in C# whose purpose is more or less to allow the user to execute scripts written by other users and restrict the permissions of that script. My program compiles ...
0
votes
0answers
39 views
Which OAuth2 Flow?
I'm just getting into OAuth2 and I'm a tad confused (you've probably heard that before)!
I am writing a small independent service which will expose a basic REST API enabling client applications to ...
3
votes
4answers
238 views
Is a cookie hash that matches with file hash safe?
I've made a simple login form. It's made very generic to be used for any project. Now I wonder if the security is good enough and if my approach is safe.
On success
When successfully logged in I do ...
3
votes
1answer
124 views
How to authenticate devices across organisation boundaries without a third party CA
I'm currently working on a protocol which passes automated instructions between separate organisations. I'm looking for a way to delegate authentication of devices to which ever organisation a device ...
1
vote
1answer
105 views
Should usernames and passwords to external systems be documented?
This is basically an extension to my previous question. That time our internal discussions didn't end up anywhere and the whole issue was forgotten for the time being.
Now we've touched upon it again,...
1
vote
1answer
83 views
Is it more secure to use more PKI keys?
Consider a token issuer/validator. Every token is PKI signed.
Is it more secure to use a new key-pair (performance could be ignored for now) per request or is it no difference to have only one key-...
1
vote
1answer
72 views
How to safely allow different end users to insert data into a table stored in an Oracle database?
This is a basic question, but I don't have any sense of what other developers do in this scenario.
The Situation
I am creating an interface to allow end users to insert and update data in a table ...
1
vote
0answers
71 views
Is my microservices architecture in line with best practises? (STS/SPA/Frontend API/Backend services)
My goal is to make an application with a SPA front end that updates in real time, incorporating microservices architecture (and for solutions CQRS design patterns and eventing with Azure Service Bus).
...
1
vote
1answer
175 views
Breaking 3-tier architecture into multi-tier architecture
Recently I have been working on a rather large system with Vue.js for a single page app (SPA) and an API for the backend. The customer is concerned with the security, performance and maintainability.
...
2
votes
3answers
394 views
Best approach to creating a secure offline login system in C#?
I'm rather new at programming so I'm still getting a grip on things.
I'm creating an offline login system in C# that will have the ability add/remove users. The computer will not be connected to the ...
3
votes
2answers
123 views
Critical dependency is preventing me from updating my app to latest framework version
My project relies on a specialized component which is stuck (by its configuration) to an older version of the framework my project is using. This makes updating to the latest version of the framework ...
11
votes
5answers
793 views
If passwords are stored hashed, how would a computer know that your password is similar to the last one if you try resetting your password?
If passwords are stored hashed, how would a computer know that your password is similar to the last one if you try resetting your password? Wouldn't the two passwords be totally different since one is ...
-2
votes
1answer
384 views
How @RolesAllowed annotation is workin in Java [closed]
I know that @RolesAllowd annotation can be used to provide role-based access control to REST endpoints and I am currently using that with RestEASY.
I need to know how it is working behind the scenes....
0
votes
1answer
65 views
Custom ACL Implementation
I have been trying to figure out an ACL solution for my application which should manage API endpoint's access rights dynamically. Some said that I have an option of Spring Security ACL. I checked it ...
0
votes
3answers
175 views
Is there any risk in creating a SSL certified site?
I was hired to program a basic, plain text site for a local business that amongst other things, provides basic pricing quotes through a Javascript Applet. For obvious reasons, it seemed unnecessary to ...
0
votes
1answer
54 views
How to manage model(s) between web client (DMZ) and web API?
I have this web API project which handle all database access via entity framework.
I have another web client reside in DMZ to call those APIs (via ajax or c#) in the web API project.
When I make API ...
0
votes
1answer
51 views
Allowing a dynamic list of IP addresses to access a specific port in an AWS EC2 Instance
The problem I am trying to solve today is DDoS. I am working on a game project which is hosted on a TCP port (7777). The game is known to have a community full of idiots (pardon the language) that do ...
1
vote
1answer
103 views
Do i need to implement Security for my webpage, if it is only connected to a LAN
I am making a websocket server that can communicate with clients.
This server is going to be on a private vLAN channel on a public place, AKA only the staff have access to the network which the ...
1
vote
2answers
233 views
Security Issues with RESTful Authentication & Session Management
I'm trying to implement authentication and session management for a microservice. In order to do the process RESTfully, I understand that I'll need to use some kind of token-based authentication to ...
-1
votes
2answers
236 views
How to process a login form data?
I have created a login form for my website, but the issue is how to process the data provided in the form by the uses.
You see, I can't just write a basic function like this one -
myfunction(){
if(...
1
vote
1answer
65 views
Single Sign On Logout Strategy
I have been working on a project that integrates spring-cloud-based microservices and MVC applications with SSO. currently, I use spring-session for the session repository service. My current ...
-2
votes
1answer
52 views
Web Security (PHP) - Is it Secure to do downloading files & presenting with Headers to the End User ?
I have security question that i am not sure if this approach is safe and secure way to download a file and present to a web user ?
We have customers invoice files stored in a server location (...
0
votes
2answers
265 views
How to create secure desktop installer that doesn't trigger a virus alert for unknown exe?
When I created a c# desktop application and move the exe file to another computer that has anti virus security, the security program shows an alert as unknown exe. I want to create a desktop ...
0
votes
1answer
59 views
Is X-Script an issue only for public web pages?
I'm struggling with X-Script attacks. I think I understand what they are but it's unclear if they only affect public facing web pages (which I will define better).
The example I often see is where ...
0
votes
3answers
165 views
How can a headless client securely know the API version of a multi-instance backend?
I'm working in a scenario where I have a backend (let's call it the server) and a frontend client app (let's call it the client).
The client is entirely headless, and can connect to any instance of ...
3
votes
2answers
121 views
How to safeguard a COTS REST API with on-premise servers for approved client apps only?
Goal: Prevent unauthorized 'clone' apps from using REST API-based solutions where the customers manage their own servers and services instead of the vendor doing so (database, resource, and identity). ...
1
vote
2answers
63 views
Securing e-commerce administrator panel with a VPN
I am developing the back-end of an e-commerce system, which has customer and administrator type accounts. These two roles do not overlap, administrators are there to do the back office work, while ...
0
votes
1answer
111 views
Security and performance considerations when creating chat system on a Flask backend
I am building a website with the Flask framework. One functionality of the site will be that users can send messages to each other.
I created a prototype of this using Flask WTF forms. The basic ...
3
votes
3answers
648 views
How to avoid pushing Github Enterprise code to my personal Github account by mistake if both are configured in my work computer?
Setting the debatability of using personal accounts on the workplace aside.
Context:
The company I work for is dedicated to creating apps for other companies. Because of this we have many different ...
0
votes
1answer
204 views
Why not put TLS certificate in DNS responses?
The security of a TLS connection relies on trusting the CA's certificate, which in turn, is usually actually a proof of DNS entry ownership. Even though the server operator may request a certificate ...
1
vote
0answers
151 views
Storing File URI and Checksum to check if the file was changed in future
right now application is storing a file data in database and we are considering instead to store a link (http, ftp, etc) to the file and its checksum. We will only provide a service and the service ...
1
vote
1answer
54 views
Should I separate the REST sessions from the sessions in the rest of the application?
Assuming I have resources I restrict access to with a username + password login in my web application and in my REST API. Should I keep different sessions for both meaning that a login via the web UI ...
