Questions tagged [security]

For questions relating to cryptography and IT security. This can be computer, network, or database security.

Filter by
Sorted by
Tagged with
1 vote
1 answer
39 views

Safe Plugin Architecture for Python Web API

I am making a web application for parameterized procedural world generation. Given the computational resources involved, this application involves a server backend for generating the world with an API ...
Groger's user avatar
  • 113
1 vote
1 answer
110 views

Open source projects, SBOMs and security

I was just reading a StackOverflow question here, about extracting the version number from a node package.json file. And the simple 'read in the json and access the property in your build tool' got ...
zola25's user avatar
  • 131
1 vote
3 answers
167 views

Handling a Refactoring Project with Limited Access to Source Code

I recently finished an interview with a company as a web developer. I'm the first and only developer that is about to be hired in this company. They have a web application that was created by a ...
Saud Alghamdi's user avatar
1 vote
2 answers
77 views

Are mature dependencies less risky than state of the art ones?

There are tools like dependabot or greenkeeper for npm and others for other languages. Now at first glance they improve security by keeping open source dependencies up-to-date. But I am wondering, do ...
Phil's user avatar
  • 119
0 votes
0 answers
53 views

Should we use sessions instead of bearer tokens with OpenID Connect server-side authorization code flows?

I want to build an app with a SPA (Angular) frontend and a REST API (Spring Boot) backend. I want a modern account system for this app: users log in through OpenID Connect, using either a social login ...
Joshua Schroijen's user avatar
9 votes
8 answers
7k views

Is Password Hashing Bad?

In software design and security, why would it not be a good idea for users to send you their passwords and it would be a better idea to delegate: use public-key auth or logging in with one of these: ...
Daniel's user avatar
  • 331
2 votes
1 answer
106 views

EU Cyber Resilience Act - Conflicting Requirements? [closed]

As a fellow SW developer in EU, I hope that you know that there is a proposal for a new law, called Cyber Resilience Act, that will, if approved, will affect all digital products on the EU market. In ...
EmbeddedNoob's user avatar
1 vote
1 answer
159 views

Is it more secure to develop libraries in-house than using existing libraries? [closed]

I (unfortunately) work in a large German corporation, in a department where the codebase is up to 20 years old, written in C++ (actually more like C with the occasional classes, since most developers ...
hyperbole's user avatar
-1 votes
2 answers
221 views

Are Physical Firewalls mandatory

I have a Delphi software application that uses non standard port nnnnn to nnnnn+50 with the FTPS protocol TLS 1.3 Until now I was suggesting my customers that the Server Side application needs to have ...
Allan's user avatar
  • 13
1 vote
2 answers
100 views

Best way to protect action links from CSRF

An application has a multifactor login. The user logs in with its e-mail and password, and then the following screen asks for a one time password received via e-mail or generated by a mobile app. In ...
user2190492's user avatar
0 votes
0 answers
31 views

Cascading ACL to embedded objects

We have an object Root, which references many other objects. Which eventually is translated into FKs on the DB level. We came up with an ACL scheme where there's a separate permissions table with the ...
Stanislav Bashkyrtsev's user avatar
2 votes
2 answers
203 views

Keeping user provided passwords to 3rd party services safe

I have a SaaS application in which users can connect their RDBMS (postgres, mysql etc) and query data from it. I'm wondering what's the best practice to keep their connection details safe. Currently, ...
Avin Kavish's user avatar
0 votes
2 answers
196 views

Best practices for a new application to be ready for post-quantum cryptography

Suppose today I'm designing a new application that will employ asymmetric cryptography to allow users to securely exchange data with one another. As far as I can tell there are no quantum-safe ...
Peter Moore's user avatar
18 votes
9 answers
5k views

Authentication and authorisation for people with intellectual disabilities

Currently, I'm involved in a research project in which we are evaluating an existing web environment providing a safe online playground for children/adolescents with intellectual disabilities. Certain ...
KDW's user avatar
  • 349
0 votes
2 answers
185 views

How to best protect a public API from unwanted requests

I’ll try my best to explain, but for the closest context I could think of, imagine that I am building an analytics platform that allows paying users to sign up, place a tracking script on their ...
user8758206's user avatar
1 vote
1 answer
99 views

Is my security pattern correct for authenticating principal users to my microservices?

We are trying to implement an authorization and authentication service for our product. Now, we would have to cater to different kinds of IAM systems like SSO, LDAP and Basic Username+Password in ...
Anirban Das's user avatar
-1 votes
1 answer
52 views

What is the best way to authenticate a user over IVR?

I am trying to build an IVR system that requires some form of username & password/pin entry to access sensitive data. My naïve solution seemed obvious enough, until I realized that username/pass ...
Noob Saibot's user avatar
0 votes
2 answers
153 views

The best way of preventing unauthorised API use and reducing costs of declining API requests

To best explain my context, imagine that I’m creating an alternative piece of software to google analytics (since my personal project’s principle is similar). Each unique user creates an account and ...
user8758206's user avatar
45 votes
5 answers
6k views

SQL sanitizing in code with no user input

In my company's codebase, we hardcode sql queries without using an ORM. Here's an example of a query we would run: UPDATE client SET status="active" WHERE client_id=123 Since the query is ...
half of a glazier's user avatar
0 votes
1 answer
176 views

Is it secured to accept and execute user provided CURL commands

Assume you have to figure out a dynamic way where the user can provide an API call to hit in the backend for example, user to provide a webhook to call on his end server So, An idea for users to ...
Youans's user avatar
  • 441
0 votes
0 answers
49 views

SSO Application Storing a Custom Secret in the User Profile

I have an application that employs "zero knowledge" data security, where even with full backend access to our application, customer data cannot be read without knowing their individual ...
Peter Moore's user avatar
1 vote
3 answers
244 views

Are interchangeable types a security vulnerability? Are they good vectors for attack?

Suppose you are given a python API: def onArgumentReceived(x): doWhatever(x) # expects a unicode string I am not a security expert by any stretch of the imagination, however on the face of this, ...
Anon's user avatar
  • 3,575
1 vote
1 answer
123 views

How to manage autorization for internal service to service communication in a microservice architecture?

At deployment time, I register my microservices in the following way: They register themselves in Keycloak to have an identity as a confidential client; Then they call an endpoint on a dedicated ...
Dypso's user avatar
  • 231
0 votes
1 answer
482 views

Can I use a session cookie for API authentication?

I want to build a web application with a Single Page Application as the front end and an API as the back end. The front-end SPA will read and write data to the API. The SPA and the API will be hosted ...
Damien Monni's user avatar
1 vote
2 answers
111 views

How can I enable user data sovereignty in a B2B SaaS application?

We develop a SaaS solution that processes customer ERP data and provides analyses from it in a front-end. The software is a standard solution and should require as little customization as possible for ...
Dennis's user avatar
  • 13
0 votes
3 answers
98 views

Should security and data validation be implemented within database or application?

I am building a simple web app where one set of users have varying admin privileges who can write to database and the other set can only view data. I am used to securing APIs with JWT or session ...
Hashir's user avatar
  • 1
0 votes
0 answers
59 views

Authorization Code Flow or Client Credential Flow for One-Time Mail Configuration

Have an enterprise web application with a Web API 2 backend and other external backend processes. Both of these send mail with or without user interaction. I identified the client credential flow as ...
David Anderson's user avatar
-2 votes
1 answer
167 views

Security implications of storing credentials in a .env file

I understand that credential leakage occurs reasonably often due to people forgetting to .gitignore a .env file I'm building an application in VueJS and right now I'm storing some S3 credentials as ...
Pierre Baudin's user avatar
1 vote
1 answer
485 views

microservice file upload/download central vs distributed api

In microservice architecture, let's say I have 4 services that will need file upload/download feature, I have two options for this: I can create another new service(5th) to expose an file upload/...
danny's user avatar
  • 119
-3 votes
1 answer
68 views

HTML Playground [closed]

I'm creating a service for creating web tools. The tool is a generated web page with some JS engine. The user can interact with the JS engine through the user interface. The user interface can be ...
christo's user avatar
  • 105
0 votes
2 answers
64 views

Personal AES keys storage idea not working reason

I went through different ideas about storing AES key for encrypting database columns, I learnt that there are the possible solutions: put the key in the database find a Key Management Service to help ...
desmond ng's user avatar
1 vote
3 answers
1k views

Designing APIs that don't expose database primary keys

People say "don't expose primary keys from the database in your API" because its a major security leak, so I'm trying to come up with a way for: RESTful HTTP requests to reference server-...
hotmeatballsoup's user avatar
0 votes
2 answers
44 views

At which points in the process/stack is Cloud data not encrypted - Cloud Security

Assume an application developed in a PaaS public cloud environment. The application stores and processes some kind of sensitive data. Encryption-at-rest seems clearly described already, and the option ...
MrSpence's user avatar
0 votes
1 answer
131 views

Should an access token really be cryptographically signed?

In a web app I'm writing, a singed-in user is recognized by their cookie containing a session identifier. That session id has sixty-four bits of entropy, so I believe brute-force attacks are ...
Schmo's user avatar
  • 113
2 votes
4 answers
188 views

Which approach can be used to verify that information has not been manipulated after it has been recorded?

I am looking for an approach to verify that some information has not been modified after a certain point in time. Let's assume a data provider records a data set at time X and provides it to a data ...
Braveness's user avatar
2 votes
3 answers
550 views

How do you reduce security risks when using NPM packages in commercial Web development?

This is a question for software engineers who are tasked with managing the development cycle for a Web application using NPM packages for deployment on a customer's Intranet or the Internet. This is ...
J.R.'s user avatar
  • 95
0 votes
2 answers
293 views

Is it a good idea to use database sequential id as a key in external key-value storage?

I use Postgres database to store user information. Some of that information is sensitive so it was decided to store that information in Vault. The user table in Postgres has id's generated by a ...
Yos's user avatar
  • 155
3 votes
1 answer
324 views

How does antivirus software protect itself from malware?

How does antivirus protect itself from malware? Some types of malware will kill the running processes and since antivirus is just another software like any other why they can't just kill the antivirus ...
Marko's user avatar
  • 43
-3 votes
1 answer
244 views

How much access should a developer have to a Staging database [closed]

We want our developers to be able to diagnose production issues in staging. For the sake of this, we are planning to make an exact replica of production into staging. We are thinking however, if we ...
James's user avatar
  • 109
0 votes
2 answers
127 views

How to verify that a legitimate (but unknown) remote asset from an unknown source has not been compromised and that its integrity remains intact?

I am familiar with and see the benefits of Subresource Integrity (SRI). I understand that with SRI, once you've added a script reference with the correct integrity attribute, if the remote script is ...
Rounin's user avatar
  • 275
0 votes
1 answer
33 views

Should I check the ownership of every "somethig_id" fields from a POST request?

I have an endpoint API for a POST request in a multi-tenant application, let's say it is for a Payment, where we have to store these fields: tenant_id (this is the account owner) amount date payer_id ...
jacopo.galli's user avatar
8 votes
1 answer
540 views

Is masking an entered password security through obscurity?

There is a practice of showing bullets, not characters when a user inputs a password. Is this security through obscurity? My first thought was that it's not, it's not really a system, we know how it ...
Awerde's user avatar
  • 327
0 votes
1 answer
1k views

What’s the standard used to deploy .env files?

I used docker to containerize the node.js express app and used GitHub action to add the .env file in the container. I googled this method when I was doing the DEV project. But I think that if someone ...
nermineslimane's user avatar
0 votes
4 answers
1k views

HOWTO: Full-text search over an encrypted database?

I want to adhere to the best practices and obviously encrypt the data sent to me by user. And I also want to provide the full-text search feature to the user (user can only search their own data, if ...
miqem's user avatar
  • 75
0 votes
1 answer
150 views

Javascript and payment security

I'm using a third party CRM application which allows you to build web forms using drag and drop widgets and the ability to add javascript code to manipulate those widgets. I need to build a form to ...
adam78's user avatar
  • 291
27 votes
9 answers
8k views

Is it a security vulnerability to declare class members as public?

I have always wondered whether public, protected, and private has security implications post compilation. Hypothetically: class Foo { public: int m_Foo; // Completely vulnerable and dangerous ...
Anon's user avatar
  • 3,575
4 votes
1 answer
1k views

If a code inspection tool finds a "heap inspection" vulnerability, is that relevant if the code is for a web app running on a private server?

Recently, at the organization I work for, we've been using a static code inspection tool. One of the more interesting findings is that private information, such as passwords, may be stored in the heap ...
Vivian River's user avatar
  • 2,397
1 vote
2 answers
387 views

How to get the CSRF token when using a cross-origin REST API?

Usually, the web server that is serving a page includes the CSRF token inside the HTML. However when I'm using a cross-origin REST API, there is no "initial" page that could include the CSRF ...
Kevin Kevinski's user avatar
0 votes
2 answers
146 views

Do I have too much access to my users' personal media?

This would be a broad question - but I'm asking specific to the situation around an app that I've developed. In short, I've written an app that allows users to persist their photos and videos to the '...
DanDev's user avatar
  • 23
0 votes
0 answers
30 views

User proof network app with distant database [duplicate]

I’m currently writing a software for my company (3rd world country), and I wanted it as simple as possible to install and maintain, so I started with Qt and no server app beside the database, (MariaDB ...
Max13's user avatar
  • 159

1
2 3 4 5
19