Questions tagged [security]
For questions relating to cryptography and IT security. This can be computer, network, or database security.
905
questions
1
vote
1
answer
39
views
Safe Plugin Architecture for Python Web API
I am making a web application for parameterized procedural world generation. Given the computational resources involved, this application involves a server backend for generating the world with an API ...
- 113
1
vote
1
answer
110
views
Open source projects, SBOMs and security
I was just reading a StackOverflow question here, about extracting the version number from a node package.json file. And the simple
'read in the json and access the property in your build tool'
got ...
- 131
1
vote
3
answers
167
views
Handling a Refactoring Project with Limited Access to Source Code
I recently finished an interview with a company as a web developer. I'm the first and only developer that is about to be hired in this company.
They have a web application that was created by a ...
1
vote
2
answers
77
views
Are mature dependencies less risky than state of the art ones?
There are tools like dependabot or greenkeeper for npm and others for other languages. Now at first glance they improve security by keeping open source dependencies up-to-date. But I am wondering, do ...
- 119
0
votes
0
answers
53
views
Should we use sessions instead of bearer tokens with OpenID Connect server-side authorization code flows?
I want to build an app with a SPA (Angular) frontend and a REST API (Spring Boot) backend.
I want a modern account system for this app: users log in through OpenID Connect, using either a social login ...
- 141
9
votes
8
answers
7k
views
Is Password Hashing Bad?
In software design and security, why would it not be a good idea for users to send you their passwords and it would be a better idea to delegate: use public-key auth or logging in with one of these: ...
- 331
2
votes
1
answer
106
views
EU Cyber Resilience Act - Conflicting Requirements? [closed]
As a fellow SW developer in EU, I hope that you know that there is a proposal for a new law, called Cyber Resilience Act, that will, if approved, will affect all digital products on the EU market.
In ...
- 31
1
vote
1
answer
159
views
Is it more secure to develop libraries in-house than using existing libraries? [closed]
I (unfortunately) work in a large German corporation, in a department where the codebase is up to 20 years old, written in C++ (actually more like C with the occasional classes, since most developers ...
- 55
-1
votes
2
answers
221
views
Are Physical Firewalls mandatory
I have a Delphi software application that uses non standard port nnnnn to nnnnn+50 with the FTPS protocol TLS 1.3
Until now I was suggesting my customers that the Server Side application needs to have
...
- 13
1
vote
2
answers
100
views
Best way to protect action links from CSRF
An application has a multifactor login.
The user logs in with its e-mail and password, and then the following screen asks for a one time password received via e-mail or generated by a mobile app.
In ...
- 313
0
votes
0
answers
31
views
Cascading ACL to embedded objects
We have an object Root, which references many other objects. Which eventually is translated into FKs on the DB level. We came up with an ACL scheme where there's a separate permissions table with the ...
2
votes
2
answers
203
views
Keeping user provided passwords to 3rd party services safe
I have a SaaS application in which users can connect their RDBMS (postgres, mysql etc) and query data from it. I'm wondering what's the best practice to keep their connection details safe. Currently, ...
- 137
0
votes
2
answers
196
views
Best practices for a new application to be ready for post-quantum cryptography
Suppose today I'm designing a new application that will employ asymmetric cryptography to allow users to securely exchange data with one another. As far as I can tell there are no quantum-safe ...
- 119
18
votes
9
answers
5k
views
Authentication and authorisation for people with intellectual disabilities
Currently, I'm involved in a research project in which we are evaluating an existing web environment providing a safe online playground for children/adolescents with intellectual disabilities. Certain ...
- 349
0
votes
2
answers
185
views
How to best protect a public API from unwanted requests
I’ll try my best to explain, but for the closest context I could think of, imagine that I am building an analytics platform that allows paying users to sign up, place a tracking script on their ...
- 121
1
vote
1
answer
99
views
Is my security pattern correct for authenticating principal users to my microservices?
We are trying to implement an authorization and authentication service for our product.
Now, we would have to cater to different kinds of IAM systems like SSO, LDAP and Basic Username+Password in ...
- 19
-1
votes
1
answer
52
views
What is the best way to authenticate a user over IVR?
I am trying to build an IVR system that requires some form of username & password/pin entry to access sensitive data. My naïve solution seemed obvious enough, until I realized that username/pass ...
- 437
0
votes
2
answers
153
views
The best way of preventing unauthorised API use and reducing costs of declining API requests
To best explain my context, imagine that I’m creating an alternative piece of software to google analytics (since my personal project’s principle is similar). Each unique user creates an account and ...
- 121
45
votes
5
answers
6k
views
SQL sanitizing in code with no user input
In my company's codebase, we hardcode sql queries without using an ORM.
Here's an example of a query we would run:
UPDATE client SET status="active" WHERE client_id=123
Since the query is ...
0
votes
1
answer
176
views
Is it secured to accept and execute user provided CURL commands
Assume you have to figure out a dynamic way where the user can provide an API call to hit in the backend
for example, user to provide a webhook to call on his end server
So, An idea for users to ...
- 441
0
votes
0
answers
49
views
SSO Application Storing a Custom Secret in the User Profile
I have an application that employs "zero knowledge" data security, where even with full backend access to our application, customer data cannot be read without knowing their individual ...
- 119
1
vote
3
answers
244
views
Are interchangeable types a security vulnerability? Are they good vectors for attack?
Suppose you are given a python API:
def onArgumentReceived(x):
doWhatever(x) # expects a unicode string
I am not a security expert by any stretch of the imagination, however on the face of this, ...
- 3,575
1
vote
1
answer
123
views
How to manage autorization for internal service to service communication in a microservice architecture?
At deployment time, I register my microservices in the following way:
They register themselves in Keycloak to have an identity as a confidential client;
Then they call an endpoint on a dedicated ...
- 231
0
votes
1
answer
482
views
Can I use a session cookie for API authentication?
I want to build a web application with a Single Page Application as the front end and an API as the back end. The front-end SPA will read and write data to the API.
The SPA and the API will be hosted ...
- 101
1
vote
2
answers
111
views
How can I enable user data sovereignty in a B2B SaaS application?
We develop a SaaS solution that processes customer ERP data and provides analyses from it in a front-end. The software is a standard solution and should require as little customization as possible for ...
- 13
0
votes
3
answers
98
views
Should security and data validation be implemented within database or application?
I am building a simple web app where one set of users have varying admin privileges who can write to database and the other set can only view data.
I am used to securing APIs with JWT or session ...
- 1
0
votes
0
answers
59
views
Authorization Code Flow or Client Credential Flow for One-Time Mail Configuration
Have an enterprise web application with a Web API 2 backend and other external backend processes. Both of these send mail with or without user interaction. I identified the client credential flow as ...
- 1,259
-2
votes
1
answer
167
views
Security implications of storing credentials in a .env file
I understand that credential leakage occurs reasonably often due to people forgetting to .gitignore a .env file
I'm building an application in VueJS and right now I'm storing some S3 credentials as ...
1
vote
1
answer
485
views
microservice file upload/download central vs distributed api
In microservice architecture, let's say I have 4 services that will need file upload/download feature, I have two options for this:
I can create another new service(5th) to expose an file
upload/...
- 119
-3
votes
1
answer
68
views
HTML Playground [closed]
I'm creating a service for creating web tools. The tool is a generated web page with some JS engine. The user can interact with the JS engine through the user interface. The user interface can be ...
- 105
0
votes
2
answers
64
views
Personal AES keys storage idea not working reason
I went through different ideas about storing AES key for encrypting database columns, I learnt that there are the possible solutions:
put the key in the database
find a Key Management Service to help ...
1
vote
3
answers
1k
views
Designing APIs that don't expose database primary keys
People say "don't expose primary keys from the database in your API" because its a major security leak, so I'm trying to come up with a way for:
RESTful HTTP requests to reference server-...
0
votes
2
answers
44
views
At which points in the process/stack is Cloud data not encrypted - Cloud Security
Assume an application developed in a PaaS public cloud environment. The application stores and processes some kind of sensitive data.
Encryption-at-rest seems clearly described already, and the option ...
- 11
0
votes
1
answer
131
views
Should an access token really be cryptographically signed?
In a web app I'm writing, a singed-in user is recognized by their cookie containing a session identifier. That session id has sixty-four bits of entropy, so I believe brute-force attacks are ...
- 113
2
votes
4
answers
188
views
Which approach can be used to verify that information has not been manipulated after it has been recorded?
I am looking for an approach to verify that some information has not been modified after a certain point in time.
Let's assume a data provider records a data set at time X and provides it to a data ...
- 29
2
votes
3
answers
550
views
How do you reduce security risks when using NPM packages in commercial Web development?
This is a question for software engineers who are tasked with managing the development cycle for a Web application using NPM packages for deployment on a customer's Intranet or the Internet.
This is ...
- 95
0
votes
2
answers
293
views
Is it a good idea to use database sequential id as a key in external key-value storage?
I use Postgres database to store user information. Some of that information is sensitive so it was decided to store that information in Vault. The user table in Postgres has id's generated by a ...
- 155
3
votes
1
answer
324
views
How does antivirus software protect itself from malware?
How does antivirus protect itself from malware?
Some types of malware will kill the running processes and since antivirus is just another software like any other why they can't just kill the antivirus ...
- 43
-3
votes
1
answer
244
views
How much access should a developer have to a Staging database [closed]
We want our developers to be able to diagnose production issues in staging. For the sake of this, we are planning to make an exact replica of production into staging. We are thinking however, if we ...
- 109
0
votes
2
answers
127
views
How to verify that a legitimate (but unknown) remote asset from an unknown source has not been compromised and that its integrity remains intact?
I am familiar with and see the benefits of Subresource Integrity (SRI).
I understand that with SRI, once you've added a script reference with the correct integrity attribute, if the remote script is ...
- 275
0
votes
1
answer
33
views
Should I check the ownership of every "somethig_id" fields from a POST request?
I have an endpoint API for a POST request in a multi-tenant application, let's say it is for a Payment, where we have to store these fields:
tenant_id (this is the account owner)
amount
date
payer_id ...
- 11
8
votes
1
answer
540
views
Is masking an entered password security through obscurity?
There is a practice of showing bullets, not characters when a user inputs a password. Is this security through obscurity?
My first thought was that it's not, it's not really a system, we know how it ...
- 327
0
votes
1
answer
1k
views
What’s the standard used to deploy .env files?
I used docker to containerize the node.js express app and used GitHub action to add the .env file in the container. I googled this method when I was doing the DEV project. But I think that if someone ...
- 125
0
votes
4
answers
1k
views
HOWTO: Full-text search over an encrypted database?
I want to adhere to the best practices and obviously encrypt the data sent to me by user. And I also want to provide the full-text search feature to the user (user can only search their own data, if ...
- 75
0
votes
1
answer
150
views
Javascript and payment security
I'm using a third party CRM application which allows you to build web forms using drag and drop widgets and the ability to add javascript code to manipulate those widgets.
I need to build a form to ...
- 291
27
votes
9
answers
8k
views
Is it a security vulnerability to declare class members as public?
I have always wondered whether public, protected, and private has security implications post compilation.
Hypothetically:
class Foo
{
public:
int m_Foo; // Completely vulnerable and dangerous
...
- 3,575
4
votes
1
answer
1k
views
If a code inspection tool finds a "heap inspection" vulnerability, is that relevant if the code is for a web app running on a private server?
Recently, at the organization I work for, we've been using a static code inspection tool.
One of the more interesting findings is that private information, such as passwords, may be stored in the heap ...
- 2,397
1
vote
2
answers
387
views
How to get the CSRF token when using a cross-origin REST API?
Usually, the web server that is serving a page includes the CSRF token inside the HTML. However when I'm using a cross-origin REST API, there is no "initial" page that could include the CSRF ...
0
votes
2
answers
146
views
Do I have too much access to my users' personal media?
This would be a broad question - but I'm asking specific to the situation around an app that I've developed.
In short, I've written an app that allows users to persist their photos and videos to the '...
- 23
0
votes
0
answers
30
views
User proof network app with distant database [duplicate]
I’m currently writing a software for my company (3rd world country), and I wanted it as simple as possible to install and maintain, so I started with Qt and no server app beside the database, (MariaDB ...
- 159