Questions tagged [security]
For questions relating to cryptography and IT security. This can be computer, network, or database security.
847
questions
-2
votes
0answers
40 views
Anonymous Login Design & Security
FYI I originally posted this on reddit, but figured the more eyes I get on this the more likely I am to get some input.
Hi guys, I wanted to hear how you guys went about implementing and securing ...
0
votes
1answer
105 views
Why do users and programs have different client authentication mechanisms?
Typically in any application, the way a user (human) is authenticated is using a username/id and a password, whereas programmatic or api based access is authenticated using API keys (based on system ...
1
vote
3answers
99 views
Better than ongoing integer and uuid as primary key
I read a lot about using ongoing numbers vs UUIDs as the primary key and had an idea how it might be possible to combine both and profit from their advantages, without their disadvantages.
The table ...
1
vote
0answers
25 views
Automatic interaction between API and secured 3rd party API
I would like to create GUI + API that calls third party API as follows:
third party API is consumed once a day by my API,
GUI user doesn’t have to log in every day (eg. can log in only once every 30 ...
0
votes
1answer
42 views
Should we use an Identity server for our core?
We are currently making the codebase for our company.
In this project we upload user data like users ID card, drive license, bills for identity confirmation and a lot of other sensitive data.
My ...
0
votes
1answer
41 views
Limiting access to telemetry API only for certain application
Let's consider such an example:
I'm an author of application like Google Chrome. I would like to my application sends anonymous telemetry logs to my server. How do I prevent somebody to use my server ...
2
votes
4answers
282 views
How to compare passwords which is stored in DB in encrypted form in secure way?
Recently In an interview I was asked this question -
Question- If are storing passwords in encrypted format in DB and in future when user login into our website how will we perform authentication?
Me:...
0
votes
3answers
62 views
How to create a code that will be send by SMS to verify that it's a valid phone number? [closed]
I'm creating a mobile app that will have a verification process of the phone number like most of apps do when they use your phone.
I'm also developing the back-end but I don't know exactly what is the ...
1
vote
3answers
163 views
Should I keep in the database a record of the user accepting the terms and coditions?
Most of applications, when you sign up, you must agree with some terms and conditions.
Should the information that the user agreed to those terms be saved in the database?
I asking this because I'm ...
0
votes
1answer
81 views
How to use an API key without knowing it?
let's say I would like to create a service like eToro that allows people to trade stocks but with their own brokers.
If I do it just for me, it's pretty straightforward:
create logic that replicates ...
1
vote
3answers
136 views
Is it a good practice to isolate the database from public APIs?
We develop web-applications using a javascript frontend framework (ReactJS), to retrieve the data to show, the user's browser calls an authenticated REST API which is our backend (Kotlin+Spring), the ...
3
votes
6answers
170 views
Error messages and security concerns
What is considered good practice for application security wise when returning errors from a backend API?
I have inherited a project with a lot of technical debt, which I intend to improve.
One ...
-2
votes
1answer
39 views
mask username and password in service file, or better approach
At work there is a given task where a python application is currently running on a server, this application is using a enviorment file, which has username and password information. The current ask is ...
-2
votes
1answer
31 views
Securing the REST APIs - Security Framework (Technology) V/S Custom
There are many ways to secure the REST APIs, from authentication and authorization view point. Below are the two which I know so far:
Using existing token based IAM solutions like Okta, KeyCloak, ...
1
vote
1answer
85 views
How to randomly allocate a set of IDs digitally, one ID per person, such that everyone knows that the particular allocations are kept private?
I have a set of UUIDs that I want to assign to a set of people. I want to deliver these UUIDs to people in a secure manner, such that everyone knows that I do not know which UUID corresponds to which ...
-1
votes
1answer
49 views
Protecting cryptocurrency private keys in a corporate environment
Now that Tesla has bought a large amount of BitCoin, other companies may follow suit. If my company wanted to do that, I was thinking about how it could be done.
I'm familiar with the way private ...
6
votes
2answers
254 views
What are best practices for enterprise software, should a developer be able to login as one of its users? (when its your own company)
My company has its own proprietary software that I have both built and maintained over the last 5 years
I am about to release a big change for all of my software to use OAuth2 instead of handling ...
0
votes
0answers
38 views
How to generate refresh token and store in database for multiple devices of one user?
Sorry for the title.
I went through possible attacks when JWT is stored inside localstorage of browsers.
Now, I am storing both accessToken and refreshToken inside a cookie with secure flag and ...
-1
votes
3answers
223 views
Offline user authentication
One of our customers had a pen test performed on our application this week and let's just say it didn't go well.
The main issue they have is that user authentication takes place on the client, rather ...
3
votes
2answers
147 views
How to assure users that an open source web application actually runs the publicized source?
I'll explain my case as an example, but I think the problem applies to other web projects as well:
I have developed a Telegram bot in Python and made its source public. Then, I have deployed the bot ...
1
vote
0answers
39 views
Securing Arbitrary Code
I need to run arbitrary code snippets in Python and Javascript on a server. It cannot be run in the browser.
I'm thinking of sandboxing the code in an AWS Lambda serveless function. However, I'm ...
0
votes
0answers
12 views
Storing string parsing function
I'm writing a system where data will be extracted from HTML formatted strings.
Different types of strings will contain the same type of data, but the methods to extract that data will vary between the ...
3
votes
1answer
156 views
How to protect an open-source distributed application consisting of clients and servers from forks made by hackers?
TL;DR: How distributed open-source apps like Scuttlebutt are secured from DoS and hackers who can make custom version of application?
I'm struggle with designing an open-source distributed application ...
3
votes
1answer
60 views
Designing a privnote clone - security considerations
I'd like to build a simple privnote-type clone for fun. The idea is this:
User A writes a note in their browser, browser encrypts it client-side
Server saves the pre-encrypted note without knowing ...
1
vote
2answers
97 views
Should I check for non-existing users with correctly signed tokens?
I ran into an issue when developing where a user that did not exist, but had a correctly signed JWT, was logged in.
This happened when I absentmindedly logged in using a browser while running the test ...
2
votes
2answers
162 views
What are the best practices to authorize every REST request?
My question may sound very naïve to someone, but it is what it is.
I have below scenario:
Relational MySQL Database with BIGINT primary keys and foreign keys
Spring boot as a backend (technology ...
0
votes
0answers
30 views
Implementing a “remember me” mechanism using access token and refresh token in a web server
I'm implementing a "remember me" feature in my web app using access tokens and refresh tokens to authenticate users (Node.js). I have a few question about this approach:
Why is a long-lived ...
-2
votes
2answers
45 views
Advice: How to secure access to photos in a React App
I have a React App (created via create-react-app) secured with OAUTH2. Currently all dynamic content is via REST APIs, secured with the same OAUTH2 token issued at login. It is hosted on AWS.
I want ...
1
vote
2answers
140 views
How do password-protected pdf documents work?
I hope this is the right site for this question...
I tutor in my spare time, and recently I downloaded a past GCSE exam paper and was attempting to edit the pdf- to select just a few pages to send to ...
0
votes
2answers
168 views
For a very long lived PHP web application project, is custom (self made) framework better than (open source) popular frameworks?
For a project that's going to live/used/maintained by the developer for a very long time (ex: 20-50 year); Is custom (self made) framework better than (open source) popular frameworks? Basically my ...
2
votes
1answer
113 views
Should a Web Application File URL Have Public or Private Access
I am debating whether to give my files a public url or a limited private one.
I am hosting various files for a mobile/web application. These will include product images and videos. Currently only ...
0
votes
1answer
61 views
OWASP Broken Access Control by example: preventing user's from reading/writing data that isn't theirs
I have experience building RBAC-based authorization mechanisms, and understand the theory behind ACLs (DAC?) though I've never had the need to implement them.
A situation was just presented to me that ...
0
votes
0answers
47 views
Application Security VS Tight coupling - High assurance of user intent
Disclaimer:
I'm not sure if this is the right site as this question sits under both software engineering and security domains.
Background:
Assume you have a financial web application that receives ...
-1
votes
1answer
117 views
Why do some tech companies share their workings on a blog for free [closed]
I was reading a blog of how a problem was solved on the Lyft blog here: https://eng.lyft.com/applying-gevent-learnings-to-deliver-value-to-users-part-4-of-4-36ad932deea8
This made me go to their main ...
1
vote
1answer
76 views
How can I share authentication information between all the server?
I'm developing a web service that have following structure:
Web Server: this is implemented with NextJS which do Server-Side Rendering and serve server-side rendered webpage data to Client.
API ...
-4
votes
1answer
72 views
Secure way to send API key
I am developing an SDK which users would use to access my service
The authorization is done using an API key, which is unique to each user.
SDK makes API calls to my server using the provided API Key
...
0
votes
1answer
103 views
What would be a good way to obtain route-specific CSRF tokens for an API?
Recently I have started rewriting my Rails app to Roda, and encountered a hiccup.
While Rails uses a single CSRF token for the entire application (and stores it in a meta tag), Roda recommends using ...
0
votes
0answers
40 views
Security and cookie practices for an API of a website
I'd like to create a web API. It would be used on my websites and potentially by others as well. I intend to use a single token to authorise users. You see, this API acts as an OAuth2 client (or ...
-2
votes
1answer
47 views
A Recipe for Handling an AWS Network Request from Start to Finish at Global Scale
I have been reading the AWS documentation for a solid 2 weeks, and configuring a terraform system to deploy a multi-region network. I have it mostly wired up, but I am not sure I have accounted for ...
0
votes
0answers
36 views
How secure LocalStorage on a SPA
I'm developing an Ionic 4 based (Angular) web application. It has a lot of logic on it and needs to store session specific data (such as a JWT, selected language, among other preferences and temporary ...
0
votes
0answers
23 views
What is required for the most secure client/server communication using HTTP2 in Node.js?
I am having trouble making Node.js HTTPS or secure HTTP2 work on localhost. But I assume localhost is a special case, and so for this question I'm asking now, I would like to know for a production ...
0
votes
0answers
53 views
Is XSS by html event injection a problem in this client-side sanitization?
I'm making my own client-side router which dynamically requests html pages from Firebase hosting, and the website uses Cloud Firestore with secure rules. Is there any XSS HTML event js injection ...
0
votes
2answers
115 views
Model for anonymous surveys preventing duplicate votes
I am working on an anonymous survey module in ERP-system and I am thinking if there is a common approach to implement such systems to make them "truly" (I do understand that there still will ...
0
votes
0answers
158 views
How to handle creating first Admin users in a web app
I'm creating a complex web app (written in Nodejs with many containerised instances running in k8s). I may end up decomposing it into microservices down the line but for now it is monolithic.
Regular ...
0
votes
3answers
142 views
What is a recommended authentication architecture for a front GUI app that I want to control but that will be used by others to control their servers?
I have a front end (WEB GUI) app that I designed (Python for now + JavaScript in the future) that I use to access a controller, it uses REST APIs.
I want to publish this app in the cloud so that ...
0
votes
0answers
25 views
Is it ok to cache the user password in Hibernate two-level cache, if not, how to avoid it?
I am working on a blog system, and use Hibernate as my ORM framework. The blog system has Post and Comment entities. Both of them has a nested author field, associated with the User entity by a ...
0
votes
0answers
44 views
ASP.NET Identity using only Active Directory
We have an existing ASP.NET web app that is using Microsoft.AspNet.Identity framework. The previous developer wrote the code for this and unfortunately I don't have much experience with it. It ...
1
vote
2answers
498 views
Can you modify the front-end source code of a mobile app?
I get that a front-end isn't secure on the web because one could theoretically access the front-end code by opening dev tools and changing the code.
Do I also need to be careful about security for a ...
4
votes
0answers
166 views
How to protect potential attackers from finding emails that are already registered?
It seems common practice to not positively indicate during a password reset attempt whether the email requested is actually registered or not. This makes sense because knowing that an email is ...
0
votes
2answers
89 views
What's the pattern to share database to other module in security perspective?
In a large iOS application, I have a database module which is dedicated to handle application databases with read/write public APIs for other module. UI module has a feature to share the database, in ...
