Questions tagged [security]
For questions relating to cryptography and IT security. This can be computer, network, or database security.
828
questions
2
votes
0answers
95 views
How to protect an open-source distributed application consisting of clients and servers from forks made by hackers?
TL;DR: How distributed open-source apps like Scuttlebutt are secured from DoS and hackers who can make custom version of application?
I'm struggle with designing an open-source distributed application ...
3
votes
1answer
54 views
Designing a privnote clone - security considerations
I'd like to build a simple privnote-type clone for fun. The idea is this:
User A writes a note in their browser, browser encrypts it client-side
Server saves the pre-encrypted note without knowing ...
1
vote
2answers
94 views
Should I check for non-existing users with correctly signed tokens?
I ran into an issue when developing where a user that did not exist, but had a correctly signed JWT, was logged in.
This happened when I absentmindedly logged in using a browser while running the test ...
2
votes
2answers
155 views
What are the best practices to authorize every REST request?
My question may sound very naïve to someone, but it is what it is.
I have below scenario:
Relational MySQL Database with BIGINT primary keys and foreign keys
Spring boot as a backend (technology ...
0
votes
0answers
30 views
Implementing a “remember me” mechanism using access token and refresh token in a web server
I'm implementing a "remember me" feature in my web app using access tokens and refresh tokens to authenticate users (Node.js). I have a few question about this approach:
Why is a long-lived ...
-2
votes
2answers
41 views
Advice: How to secure access to photos in a React App
I have a React App (created via create-react-app) secured with OAUTH2. Currently all dynamic content is via REST APIs, secured with the same OAUTH2 token issued at login. It is hosted on AWS.
I want ...
1
vote
2answers
133 views
How do password-protected pdf documents work?
I hope this is the right site for this question...
I tutor in my spare time, and recently I downloaded a past GCSE exam paper and was attempting to edit the pdf- to select just a few pages to send to ...
0
votes
2answers
141 views
For a very long lived PHP web application project, is custom (self made) framework better than (open source) popular frameworks?
For a project that's going to live/used/maintained by the developer for a very long time (ex: 20-50 year); Is custom (self made) framework better than (open source) popular frameworks? Basically my ...
2
votes
1answer
105 views
Should a Web Application File URL Have Public or Private Access
I am debating whether to give my files a public url or a limited private one.
I am hosting various files for a mobile/web application. These will include product images and videos. Currently only ...
0
votes
0answers
61 views
How do I store secret keys in a Java Web Application?
I'm developing a small website with a React frontend and a REST API built in Java as the backend. The REST API will be compiled packaged into a .war file and uploaded to a payara server, which is run ...
0
votes
1answer
56 views
OWASP Broken Access Control by example: preventing user's from reading/writing data that isn't theirs
I have experience building RBAC-based authorization mechanisms, and understand the theory behind ACLs (DAC?) though I've never had the need to implement them.
A situation was just presented to me that ...
0
votes
0answers
47 views
Application Security VS Tight coupling - High assurance of user intent
Disclaimer:
I'm not sure if this is the right site as this question sits under both software engineering and security domains.
Background:
Assume you have a financial web application that receives ...
-1
votes
1answer
115 views
Why do some tech companies share their workings on a blog for free [closed]
I was reading a blog of how a problem was solved on the Lyft blog here: https://eng.lyft.com/applying-gevent-learnings-to-deliver-value-to-users-part-4-of-4-36ad932deea8
This made me go to their main ...
1
vote
1answer
65 views
How can I share authentication information between all the server?
I'm developing a web service that have following structure:
Web Server: this is implemented with NextJS which do Server-Side Rendering and serve server-side rendered webpage data to Client.
API ...
-4
votes
1answer
62 views
Secure way to send API key
I am developing an SDK which users would use to access my service
The authorization is done using an API key, which is unique to each user.
SDK makes API calls to my server using the provided API Key
...
0
votes
1answer
103 views
What would be a good way to obtain route-specific CSRF tokens for an API?
Recently I have started rewriting my Rails app to Roda, and encountered a hiccup.
While Rails uses a single CSRF token for the entire application (and stores it in a meta tag), Roda recommends using ...
0
votes
0answers
34 views
Security and cookie practices for an API of a website
I'd like to create a web API. It would be used on my websites and potentially by others as well. I intend to use a single token to authorise users. You see, this API acts as an OAuth2 client (or ...
-2
votes
1answer
43 views
A Recipe for Handling an AWS Network Request from Start to Finish at Global Scale
I have been reading the AWS documentation for a solid 2 weeks, and configuring a terraform system to deploy a multi-region network. I have it mostly wired up, but I am not sure I have accounted for ...
0
votes
0answers
36 views
How secure LocalStorage on a SPA
I'm developing an Ionic 4 based (Angular) web application. It has a lot of logic on it and needs to store session specific data (such as a JWT, selected language, among other preferences and temporary ...
0
votes
0answers
20 views
What is required for the most secure client/server communication using HTTP2 in Node.js?
I am having trouble making Node.js HTTPS or secure HTTP2 work on localhost. But I assume localhost is a special case, and so for this question I'm asking now, I would like to know for a production ...
0
votes
0answers
40 views
Is XSS by html event injection a problem in this client-side sanitization?
I'm making my own client-side router which dynamically requests html pages from Firebase hosting, and the website uses Cloud Firestore with secure rules. Is there any XSS HTML event js injection ...
0
votes
2answers
83 views
Model for anonymous surveys preventing duplicate votes
I am working on an anonymous survey module in ERP-system and I am thinking if there is a common approach to implement such systems to make them "truly" (I do understand that there still will ...
0
votes
0answers
64 views
How to handle creating first Admin users in a web app
I'm creating a complex web app (written in Nodejs with many containerised instances running in k8s). I may end up decomposing it into microservices down the line but for now it is monolithic.
Regular ...
0
votes
3answers
136 views
What is a recommended authentication architecture for a front GUI app that I want to control but that will be used by others to control their servers?
I have a front end (WEB GUI) app that I designed (Python for now + JavaScript in the future) that I use to access a controller, it uses REST APIs.
I want to publish this app in the cloud so that ...
0
votes
0answers
24 views
Is it ok to cache the user password in Hibernate two-level cache, if not, how to avoid it?
I am working on a blog system, and use Hibernate as my ORM framework. The blog system has Post and Comment entities. Both of them has a nested author field, associated with the User entity by a ...
0
votes
0answers
32 views
ASP.NET Identity using only Active Directory
We have an existing ASP.NET web app that is using Microsoft.AspNet.Identity framework. The previous developer wrote the code for this and unfortunately I don't have much experience with it. It ...
1
vote
2answers
221 views
Can you modify the front-end source code of a mobile app?
I get that a front-end isn't secure on the web because one could theoretically access the front-end code by opening dev tools and changing the code.
Do I also need to be careful about security for a ...
4
votes
0answers
165 views
How to protect potential attackers from finding emails that are already registered?
It seems common practice to not positively indicate during a password reset attempt whether the email requested is actually registered or not. This makes sense because knowing that an email is ...
0
votes
2answers
89 views
What's the pattern to share database to other module in security perspective?
In a large iOS application, I have a database module which is dedicated to handle application databases with read/write public APIs for other module. UI module has a feature to share the database, in ...
0
votes
2answers
77 views
How can I protect sensitive information inside a binary?
I am currently developing an application with Qt/C++ which needs to access a Shopify store using the Admin API. In order to access the API, my application needs to know the following information:
API ...
1
vote
1answer
48 views
Designing Kafka topics for secured event driven job scheduling system
Consider the following
Group A
Job A {
Depends on Job B of Group A
Run User -> User1
}
Job B {
Depends on Job C and Job D of Group A
Run User -> User2
}
Job C {
Depends ...
1
vote
0answers
16 views
Defining custom OIDC provider with delegating authentication to another OIDC provider and using own authorization database
I wanted to ask about your ideas on how to solve the problem that I have to solve in my application (App1). This is the classic Fronted + Backend (Angular + Java EE) application to which I am ...
1
vote
1answer
71 views
Do you need to implement TLS versions < 1.3 if you were to implement a TLS supporting library today?
I am looking at all the green and red boxes here, and am wondering what it would look like if one were to "implement TLS" today? What should you implement if you were to implement TLS today?
Do you ...
1
vote
3answers
185 views
hash-like algorithm to identify passwords which are “too similar” to previous ones from history
One common issue with secure passwords is that users tend to "cheat", one common cheating pattern we meet recently is the "password swap" antipattern where the user basically keeps using the same two ...
1
vote
3answers
538 views
How can we learn from Flash's vulnerabilities? [closed]
The main reason, to my understanding, that Flash is being phased out is that it is fundamentally insecure (i.e. it isn't just tons of individual issues; it's insecure on a 'core' level). I severely ...
-4
votes
2answers
64 views
How do browsers isolate traffic within a single tab?
I know that browsers use a separate port for each tab. However, in each tab, there might be multiple scripts doing data transfer over the network. How does a browser makes sure that the data is ...
0
votes
1answer
60 views
How should I distribute my app with my own OAuth2 client ID, without letting anyone find it out?
I've written an app using golang which uses OAuth2(Authorization code flow with PKCE) to interact with the Gmail API.
If I build the app using my own client ID then my client ID can easily be found ...
2
votes
0answers
38 views
Api Authorization for first party apps and third party apps
I have a few microservices that i would like to combine in form of an api. The main purpose of the api is to be used by our (first party) mobile app. A side note, we don't have a mobile app or web app ...
2
votes
1answer
91 views
How do projects manage security with so many dependencies in open source projects?
Some node.js libraries (just as an example) can pull in literally hundreds of dependencies. Some of these dependencies are small packages that only have one contributor. Often times the contributor ...
3
votes
1answer
40 views
Storing username and password for another site in Node and MongoDB
This is not about storing my user's login details in the app, I already use hash and JWT tokens for that. There is a part of our app where we need to store the login details of the user for another ...
3
votes
3answers
143 views
How does authentication work for offline software?
I am wondering how software with premium modes, such as Spotify, can operate offline. If a user is not connected to the internet, then they cannot authenticate via a remote server, which has e.g. a ...
1
vote
0answers
57 views
Using Azure AD MSAL as only authentication solution for SPA
I have an Angular SPA and I spun up my own basic form-based authentication using a .net core web API and SQL server to store user accounts / hashed and salted credentials. This is obviously not an ...
1
vote
2answers
141 views
Does POP suffer from any inherent security problems
I recall seeing a large email corporation discourage POP client access, suggesting it was insecure.
Assuming this is not FUD meant to encourage adoption of their client, I am wondering whether either ...
-2
votes
4answers
192 views
Is it required for an app developer to know information security?
So I've been an indie apps developer for 2 years (I launched my first Android app at the end of 2017), and I've built few apps since then, but all of them were simple apps.
Currently I'm planning my ...
1
vote
0answers
73 views
How to trust servers in a network where anyone can add its own
I'm building a multiplayer game where anyone can add its own server but there is only one central server that contains the database where player information, like experience and gold, are stored. To ...
0
votes
0answers
17 views
Programmatic Application login into Jhipster Application
Let's say you have created a monolithic jhipster application with JWT authentication and where typically the login is by a user registering themselves and activating through email:
Let's say that ...
2
votes
3answers
180 views
Securing REST API with authenticated user
I want to build a REST API but I have some holes when it comes to the security part. I would like to get my head around how to authenticate the calls to the API.
Therefore, this is my first draft for ...
2
votes
3answers
233 views
Is it good or bad practice to use the user email in two separate columns of the user SQL table?
I'm fairly new to web development and I have a bit of a weird question.
I'm currently working on a personal project that may or may not eventually become a real, commercialized product.
In my ...
0
votes
0answers
83 views
How can i implement two way asymmetric encryption for my app and backend server?
I'm planning to setup a hybrid encryption procedure in my app. So basically i did encryption for data send from client to server using this method, now i'm confused on how to encrypt data send from ...
2
votes
1answer
88 views
Delegating authorization across multiple API's
I'm building a multi-tenant system that consists of one (SPA) client, calling multiple API's, all under my control.
User authentication is done with OpenID Connect, I'm sending an ID and access token ...
