Skip to main content
OverflowAI is here! AI power for your Stack Overflow for Teams knowledge community. Learn more

Questions tagged [security]

For questions relating to cryptography and IT security. This can be computer, network, or database security.

Filter by
Sorted by
Tagged with
0 votes
1 answer
101 views

Necessity of one-time codes in 2FA

Why is it that some services, when they conduct 2FA ask you to rewrite a code from an app, even if that app is part of that service's infrastructure? For example, when I log in via the web to ...
Karaal's user avatar
  • 9
3 votes
2 answers
414 views

How does "remember this computer" work?

Website multifactor authentication prompts will often include a "remember this computer" checkbox. How does this work? In order to be secure, it needs to be more than just a cookie, as a ...
Mud's user avatar
  • 476
-2 votes
2 answers
221 views

Avoiding `.env` in revision control while still being able to open source on a whim

From the 12-factors, III Config: A litmus test for whether an app has all config correctly factored out of the code is whether the codebase could be made open source at any moment, without ...
nicholaswmin's user avatar
  • 1,883
0 votes
0 answers
47 views

isolating user run scripts on docker without performance impact

Scenario: We have a application (web based), in a small part of this application a users is able to create a small python script to mutate (in memory) data. Currently all of these scripts (if it is ...
Vincent's user avatar
  • 375
0 votes
2 answers
141 views

Allow command execution in config file?

My friend and I are developing a screenshot tool for Linux where the screenshot can be saved into a clipboard by using an external tool like xclip or wl-clipboard. Since there are even more clipboard ...
TornaxO7's user avatar
  • 103
0 votes
1 answer
182 views

Should I store session id in server database?

I wanted to implement login system using flask framework. I managed to do this using sessions and set them to expire after 31 days and it works (sessions are created using server secret key, timestamp ...
Paweł Michoń's user avatar
1 vote
1 answer
113 views

Security: Send CompanyId on the http header

I have a web app which authenticates the user using an external identity provider (Microsoft Entra with MSAL library). This give us an access token to access our API. After authentication (so, we ...
zameb's user avatar
  • 121
0 votes
2 answers
163 views

How best to securely store a password for automated access (no user interaction)?

I'm facing the classic chicken/egg problem of where to store the keys to the kingdom. I'm building an application for retail distribution that will rely on receiving a cadence of regularly-issued Let'...
InteXX's user avatar
  • 245
0 votes
1 answer
124 views

Java Security, How important is the version of JDK for building vs running the Application

How important is the minor version of the Java Build SDK vs. the JDK version at runtime, is it a problem if the minor version is a bit outdated, if the run time version is still up to date? More ...
xyz1234's user avatar
  • 11
0 votes
1 answer
76 views

How to control, or moderate, files uploaded with a bug report?

Presume a desktop application presents a Problem Reporting interface as part of it's GUI, and I wish to allow users to upload files as part of that PR. One would hope this is only ever used for ...
mountainred's user avatar
2 votes
1 answer
60 views

Azure Managed Identity and Zero Trust

Azure Managed Identity provides a mean to only allow explicitly defined users/apps to access a given resource. For instance I can setup that no-one can access my database except the Managed Identities ...
Jakob Busk Sørensen's user avatar
0 votes
0 answers
56 views

Maintaining modularity while keeping (secret) configuration separate from application code

This is more a curiosity/query-for-information than anything; apologies if it's thus a little malformed: This is relevant to a useful API-querying library that can be shared across multiple teams ...
AmagicalFishy's user avatar
1 vote
2 answers
372 views

Restricting access to sensitive data in monorepo

Imagine that you have a large monorepo code base running as a monolith application. This application is backed by a database. Some of the data in the database is sensitive, so you want to restrict ...
Matt D's user avatar
  • 19
0 votes
0 answers
50 views

How to handle roles and scopes using oauth2 auth flow

I'm using python and fastapi with oauth2 flow (just for clarification as the question isn't language specific). I'm confused on how to implement scopes in an efficient and secure way. I was thinking ...
Gabriel Macus's user avatar
1 vote
1 answer
97 views

Safe Plugin Architecture for Python Web API

I am making a web application for parameterized procedural world generation. Given the computational resources involved, this application involves a server backend for generating the world with an API ...
Groger's user avatar
  • 113
1 vote
1 answer
130 views

Open source projects, SBOMs and security

I was just reading a StackOverflow question here, about extracting the version number from a node package.json file. And the simple 'read in the json and access the property in your build tool' got ...
zola25's user avatar
  • 131
1 vote
3 answers
187 views

Handling a Refactoring Project with Limited Access to Source Code

I recently finished an interview with a company as a web developer. I'm the first and only developer that is about to be hired in this company. They have a web application that was created by a ...
Saud Alghamdi's user avatar
1 vote
2 answers
87 views

Are mature dependencies less risky than state of the art ones?

There are tools like dependabot or greenkeeper for npm and others for other languages. Now at first glance they improve security by keeping open source dependencies up-to-date. But I am wondering, do ...
Phil's user avatar
  • 119
0 votes
0 answers
194 views

Should we use sessions instead of bearer tokens with OpenID Connect server-side authorization code flows?

I want to build an app with a SPA (Angular) frontend and a REST API (Spring Boot) backend. I want a modern account system for this app: users log in through OpenID Connect, using either a social login ...
Joshua Schroijen's user avatar
9 votes
8 answers
7k views

Is Password Hashing Bad?

In software design and security, why would it not be a good idea for users to send you their passwords and it would be a better idea to delegate: use public-key auth or logging in with one of these: ...
Daniel's user avatar
  • 517
2 votes
1 answer
122 views

EU Cyber Resilience Act - Conflicting Requirements? [closed]

As a fellow SW developer in EU, I hope that you know that there is a proposal for a new law, called Cyber Resilience Act, that will, if approved, will affect all digital products on the EU market. In ...
EmbeddedNoob's user avatar
1 vote
1 answer
166 views

Is it more secure to develop libraries in-house than using existing libraries? [closed]

I (unfortunately) work in a large German corporation, in a department where the codebase is up to 20 years old, written in C++ (actually more like C with the occasional classes, since most developers ...
hyperbole's user avatar
-1 votes
2 answers
234 views

Are Physical Firewalls mandatory

I have a Delphi software application that uses non standard port nnnnn to nnnnn+50 with the FTPS protocol TLS 1.3 Until now I was suggesting my customers that the Server Side application needs to have ...
Allan's user avatar
  • 13
1 vote
2 answers
214 views

Best way to protect action links from CSRF

An application has a multifactor login. The user logs in with its e-mail and password, and then the following screen asks for a one time password received via e-mail or generated by a mobile app. In ...
user2190492's user avatar
0 votes
0 answers
42 views

Cascading ACL to embedded objects

We have an object Root, which references many other objects. Which eventually is translated into FKs on the DB level. We came up with an ACL scheme where there's a separate permissions table with the ...
Stanislav Bashkyrtsev's user avatar
0 votes
2 answers
313 views

Keeping user provided passwords to 3rd party services safe

I have a SaaS application in which users can connect their RDBMS (postgres, mysql etc) and query data from it. I'm wondering what's the best practice to keep their connection details safe. Currently, ...
Avin Kavish's user avatar
0 votes
2 answers
338 views

Best practices for a new application to be ready for post-quantum cryptography

Suppose today I'm designing a new application that will employ asymmetric cryptography to allow users to securely exchange data with one another. As far as I can tell there are no quantum-safe ...
Peter Moore's user avatar
18 votes
9 answers
5k views

Authentication and authorisation for people with intellectual disabilities

Currently, I'm involved in a research project in which we are evaluating an existing web environment providing a safe online playground for children/adolescents with intellectual disabilities. Certain ...
KDW's user avatar
  • 349
0 votes
2 answers
207 views

How to best protect a public API from unwanted requests

I’ll try my best to explain, but for the closest context I could think of, imagine that I am building an analytics platform that allows paying users to sign up, place a tracking script on their ...
user8758206's user avatar
1 vote
1 answer
101 views

Is my security pattern correct for authenticating principal users to my microservices?

We are trying to implement an authorization and authentication service for our product. Now, we would have to cater to different kinds of IAM systems like SSO, LDAP and Basic Username+Password in ...
Anirban Das's user avatar
-1 votes
1 answer
83 views

What is the best way to authenticate a user over IVR?

I am trying to build an IVR system that requires some form of username & password/pin entry to access sensitive data. My naïve solution seemed obvious enough, until I realized that username/pass ...
Noob Saibot's user avatar
0 votes
2 answers
161 views

The best way of preventing unauthorised API use and reducing costs of declining API requests

To best explain my context, imagine that I’m creating an alternative piece of software to google analytics (since my personal project’s principle is similar). Each unique user creates an account and ...
user8758206's user avatar
45 votes
5 answers
7k views

SQL sanitizing in code with no user input

In my company's codebase, we hardcode sql queries without using an ORM. Here's an example of a query we would run: UPDATE client SET status="active" WHERE client_id=123 Since the query is ...
half of a glazier's user avatar
0 votes
1 answer
210 views

Is it secured to accept and execute user provided CURL commands

Assume you have to figure out a dynamic way where the user can provide an API call to hit in the backend for example, user to provide a webhook to call on his end server So, An idea for users to ...
Youans's user avatar
  • 461
0 votes
0 answers
51 views

SSO Application Storing a Custom Secret in the User Profile

I have an application that employs "zero knowledge" data security, where even with full backend access to our application, customer data cannot be read without knowing their individual ...
Peter Moore's user avatar
1 vote
3 answers
269 views

Are interchangeable types a security vulnerability? Are they good vectors for attack?

Suppose you are given a python API: def onArgumentReceived(x): doWhatever(x) # expects a unicode string I am not a security expert by any stretch of the imagination, however on the face of this, ...
Anon's user avatar
  • 3,613
1 vote
1 answer
277 views

How to manage autorization for internal service to service communication in a microservice architecture?

At deployment time, I register my microservices in the following way: They register themselves in Keycloak to have an identity as a confidential client; Then they call an endpoint on a dedicated ...
Dypso's user avatar
  • 231
0 votes
1 answer
893 views

Can I use a session cookie for API authentication?

I want to build a web application with a Single Page Application as the front end and an API as the back end. The front-end SPA will read and write data to the API. The SPA and the API will be hosted ...
Damien Monni's user avatar
1 vote
2 answers
152 views

How can I enable user data sovereignty in a B2B SaaS application?

We develop a SaaS solution that processes customer ERP data and provides analyses from it in a front-end. The software is a standard solution and should require as little customization as possible for ...
Dennis's user avatar
  • 13
0 votes
3 answers
145 views

Should security and data validation be implemented within database or application?

I am building a simple web app where one set of users have varying admin privileges who can write to database and the other set can only view data. I am used to securing APIs with JWT or session ...
Hashir's user avatar
  • 1
-2 votes
1 answer
215 views

Security implications of storing credentials in a .env file

I understand that credential leakage occurs reasonably often due to people forgetting to .gitignore a .env file I'm building an application in VueJS and right now I'm storing some S3 credentials as ...
Pierre Baudin's user avatar
1 vote
1 answer
668 views

microservice file upload/download central vs distributed api

In microservice architecture, let's say I have 4 services that will need file upload/download feature, I have two options for this: I can create another new service(5th) to expose an file upload/...
danny's user avatar
  • 119
-3 votes
1 answer
72 views

HTML Playground [closed]

I'm creating a service for creating web tools. The tool is a generated web page with some JS engine. The user can interact with the JS engine through the user interface. The user interface can be ...
christo's user avatar
  • 105
0 votes
2 answers
66 views

Personal AES keys storage idea not working reason

I went through different ideas about storing AES key for encrypting database columns, I learnt that there are the possible solutions: put the key in the database find a Key Management Service to help ...
desmond ng's user avatar
1 vote
3 answers
3k views

Designing APIs that don't expose database primary keys

People say "don't expose primary keys from the database in your API" because its a major security leak, so I'm trying to come up with a way for: RESTful HTTP requests to reference server-...
hotmeatballsoup's user avatar
0 votes
2 answers
49 views

At which points in the process/stack is Cloud data not encrypted - Cloud Security

Assume an application developed in a PaaS public cloud environment. The application stores and processes some kind of sensitive data. Encryption-at-rest seems clearly described already, and the option ...
MrSpence's user avatar
0 votes
1 answer
176 views

Should an access token really be cryptographically signed?

In a web app I'm writing, a singed-in user is recognized by their cookie containing a session identifier. That session id has sixty-four bits of entropy, so I believe brute-force attacks are ...
Schmo's user avatar
  • 113
2 votes
4 answers
206 views

Which approach can be used to verify that information has not been manipulated after it has been recorded?

I am looking for an approach to verify that some information has not been modified after a certain point in time. Let's assume a data provider records a data set at time X and provides it to a data ...
Braveness's user avatar
2 votes
3 answers
611 views

How do you reduce security risks when using NPM packages in commercial Web development?

This is a question for software engineers who are tasked with managing the development cycle for a Web application using NPM packages for deployment on a customer's Intranet or the Internet. This is ...
J.R.'s user avatar
  • 95
0 votes
2 answers
498 views

Is it a good idea to use database sequential id as a key in external key-value storage?

I use Postgres database to store user information. Some of that information is sensitive so it was decided to store that information in Vault. The user table in Postgres has id's generated by a ...
Yos's user avatar
  • 157

1
2 3 4 5
19