Questions tagged [security]
For questions relating to cryptography and IT security. This can be computer, network, or database security.
0
votes
1answer
29 views
How to manage model(s) between web client (DMZ) and web API?
I have this web API project which handle all database access via entity framework.
I have another web client reside in DMZ to call those APIs (via ajax or c#) in the web API project.
When I make API ...
-2
votes
1answer
46 views
How to implement security and authentication with a React/ Node.js and PHP based web app [closed]
First, I would like to say I understand if this may not exactly follow the general guidelines of a good question due to it's open-ended nature, but I do genuinely need advice on this subject.
I am ...
0
votes
1answer
33 views
NodeJS - Mitigating Supply Chain attacks [closed]
JavaScript and NodeJs in particular are incredibly popular however one of it's key strengths is also a weakness, the use of open source modules.
My question is specifically around how you can ...
0
votes
1answer
31 views
Allowing a dynamic list of IP addresses to access a specific port in an AWS EC2 Instance
The problem I am trying to solve today is DDoS. I am working on a game project which is hosted on a TCP port (7777). The game is known to have a community full of idiots (pardon the language) that do ...
0
votes
1answer
63 views
Do i need to implement Security for my webpage, if it is only connected to a LAN
I am making a websocket server that can communicate with clients.
This server is going to be on a private vLAN channel on a public place, AKA only the staff have access to the network which the ...
1
vote
2answers
83 views
Security Issues with RESTful Authentication & Session Management
I'm trying to implement authentication and session management for a microservice. In order to do the process RESTfully, I understand that I'll need to use some kind of token-based authentication to ...
-1
votes
2answers
78 views
How to process a login form data?
I have created a login form for my website, but the issue is how to process the data provided in the form by the uses.
You see, I can't just write a basic function like this one -
myfunction(){
if(...
1
vote
1answer
50 views
Single Sign On Logout Strategy
I have been working on a project that integrates spring-cloud-based microservices and MVC applications with SSO. currently, I use spring-session for the session repository service. My current ...
-2
votes
1answer
48 views
Web Security (PHP) - Is it Secure to do downloading files & presenting with Headers to the End User ?
I have security question that i am not sure if this approach is safe and secure way to download a file and present to a web user ?
We have customers invoice files stored in a server location (...
0
votes
2answers
158 views
How to create secure desktop installer that doesn't trigger a virus alert for unknown exe?
When I created a c# desktop application and move the exe file to another computer that has anti virus security, the security program shows an alert as unknown exe. I want to create a desktop ...
0
votes
1answer
56 views
Is X-Script an issue only for public web pages?
I'm struggling with X-Script attacks. I think I understand what they are but it's unclear if they only affect public facing web pages (which I will define better).
The example I often see is where ...
0
votes
3answers
147 views
How can a headless client securely know the API version of a multi-instance backend?
I'm working in a scenario where I have a backend (let's call it the server) and a frontend client app (let's call it the client).
The client is entirely headless, and can connect to any instance of ...
3
votes
2answers
107 views
How to safeguard a COTS REST API with on-premise servers for approved client apps only?
Goal: Prevent unauthorized 'clone' apps from using REST API-based solutions where the customers manage their own servers and services instead of the vendor doing so (database, resource, and identity). ...
1
vote
2answers
57 views
Securing e-commerce administrator panel with a VPN
I am developing the back-end of an e-commerce system, which has customer and administrator type accounts. These two roles do not overlap, administrators are there to do the back office work, while ...
0
votes
1answer
105 views
Security and performance considerations when creating chat system on a Flask backend
I am building a website with the Flask framework. One functionality of the site will be that users can send messages to each other.
I created a prototype of this using Flask WTF forms. The basic ...
3
votes
3answers
376 views
How to avoid pushing Github Enterprise code to my personal Github account by mistake if both are configured in my work computer?
Setting the debatability of using personal accounts on the workplace aside.
Context:
The company I work for is dedicated to creating apps for other companies. Because of this we have many different ...
-1
votes
1answer
177 views
Why not put TLS certificate in DNS responses?
The security of a TLS connection relies on trusting the CA's certificate, which in turn, is usually actually a proof of DNS entry ownership. Even though the server operator may request a certificate ...
1
vote
0answers
131 views
Storing File URI and Checksum to check if the file was changed in future
right now application is storing a file data in database and we are considering instead to store a link (http, ftp, etc) to the file and its checksum. We will only provide a service and the service ...
1
vote
1answer
49 views
Should I separate the REST sessions from the sessions in the rest of the application?
Assuming I have resources I restrict access to with a username + password login in my web application and in my REST API. Should I keep different sessions for both meaning that a login via the web UI ...
0
votes
2answers
95 views
Mitigate a hacking attempt when it is detected by an app sitting behind a WAF
Let's say I have a web application where my users can log in, and save resources through my API and an ajax call. Now let's say I put my web application behind a Web Application Firewall (like ...
0
votes
1answer
61 views
Password manager inside application
Firstly this is not about how to store password for access to the application itself. That is handled using .Net Identity. Authentication is handled using JWT. So it is a web application.
The problem ...
8
votes
2answers
483 views
Best practice for sensitive information in source control
I know this topic has been covered quite a lot but I can't find an answer to my specific situation.
Currently, I'm using .gitignore to exclude sensitive content and keeping it (config files, etc) ...
3
votes
1answer
193 views
How do you ensure external dependencies aren't a security risk?
We use quite a few external open source libraries in our projects, pulled in from Maven Central etc.
I was wondering what is best practice to ensuring that you don't introduce some sort of security ...
2
votes
2answers
1k views
Should we store JWTs in database?
While creating/assigning the JWTs to users, should we also store them in our databases?
The negatives/cons of storing tokens in database would be, that all the data in the payload of the JWT token is ...
4
votes
1answer
1k views
Should access permissions and roles be included in payload of JWT?
Should information about the permissions and roles of the client be included in JWT?
Having such information in JWT token will be very helpful as everytime a valid token comes, it would be easier to ...
-1
votes
1answer
24 views
How to implement linkedin authentication/data sharing with multi party?
Hi I am working on application 2.
My application interacts with application 1 and 3.
Clients of application 1 need to be to share their linkedin profile information with application 3.
I have ...
0
votes
0answers
156 views
Strategy regarding an (almost always) offline app
I'm currently in internship in a software/app development company, where I have to come up with an idea about how can we handle the fact that the user will mostly use an app offline.
Basically, the ...
2
votes
1answer
82 views
Is it a good idea to reload the page every few failed login attempt?
I was reading about bruteforce login attack and one of the solution to prevent users from trying too many passwords in short amount of time is to add exponential delay for every failed login. But ...
3
votes
3answers
117 views
How to pass credentials to client
When installing application on client's server at the end of the project, how to give admin's password to client? (On paper, by word?) Client may not be very technical so script generating password ...
1
vote
2answers
260 views
token authentication security best practice
So I'm trying a few token based authentication in Laravel, each user have token they can use to access certain database. But there is something I still don't understand from these tutorial. The ...
1
vote
1answer
357 views
Do I need to secure communications between microservices in a cluster?
So, let's say I have a standard set up for application, that is:
- split into micro services
- and is running in a cluster (kubernetes or docker swarm, I guess specific implementation does not matter, ...
-2
votes
2answers
193 views
How much damage can a rogue PHP developer do?
It's often convenient to hire a remote contractor for front-end development. Frameworks, like Laravel, use PHP to render front-end so it would make sense to give the front-end developer rights to edit ...
0
votes
3answers
176 views
How far do you go in server-side validation of POST/GET requests?
Our application had a few vulnerabilities detected by AppScan and we had to add server-side validation to catch SQL injection attempts.
But my question is, how far do you go in server-side ...
1
vote
1answer
73 views
How to make a secure web-app account system?
i have some experience (mostly as a student) with react and redux, and on the other hand i also have some experience with express, normally for my apps (all of them are really simple) i make a rest ...
2
votes
3answers
353 views
Store password in open source project
I have a fairly simple problem currently but I cannot get a solution, maybe someone here has a good idea.
I am working on an open source CMS for artists called Jinya CMS. The whole project originated ...
0
votes
0answers
39 views
OAuth2 authorization and storing users to custom storage
My question is relating to securing API with Google OAuth2 authorization and multiple clients.
But I also want to store users to my own storage so I can have additional info about them. So when the ...
-2
votes
1answer
303 views
What technical documentation to share and not to share to a wide public?
I work as a backend developer in a financial organisation and the organisation has demanded that we migrate all our technical documentation (e.g. info about batches like the names and their scheduling ...
2
votes
1answer
386 views
Designing authentication and authorisation micro service
Background:
There are three different applications A, B and C and they all share same user details but I had to implement authentication in each of them which was duplication of effort.
After some ...
1
vote
1answer
35 views
Architecture for a secure server control panel
Currently I am working on an open source server control panel similar to cPanel, Plesk but I am not sure what would be the best approach to make system changes which require root permissions.
I was ...
1
vote
3answers
700 views
Proposed Method to Restrict API Access to Mobile App Only
I read a lot that you can't restrict your Public REST API to only your mobile application, but I have an idea and I want opinions on it:
Variable App Key Method
Mobile App
Get IP address of current ...
1
vote
4answers
284 views
How does anti-malware decide if my application is harmless or not?
Suppose I have created an application that makes remote connections and does stuff, how does an anti-virus/anti-malware program decide if my app is harmful?
I know there is a signature they check for ...
4
votes
3answers
228 views
Preventing in database record tampering?
My question regards the best practice / industry standards to prevent rogue users/admins from directly logging into the database console and updating sensitive information such as financial info / ...
4
votes
2answers
263 views
Running untrusted python code safely
I've seen a couple other posts about people trying to run untrusted user inputted code into a eval or exec statement.
My implementation checks the code before hand for any import statements, makes ...
0
votes
1answer
199 views
Is it a good idea to load all user data on top of each file including sensitive information?
I've written a User class like this:
<?php
class User{
private $id;
private $username;
private $password;
private $name;
private $email;
private $key;
private $phone;
...
5
votes
1answer
152 views
How to configure HTTPS for deployments without a host name
I currently am in charge of networked linux based hardware that exposes HTTP connections. I want to be able to connect to these through HTTPS, but the hardware deployment has 1000's of installations. ...
0
votes
0answers
107 views
Front-end-side encryption: Where to store password throughout session?
currently we're working on a small application where we store a bunch of JSON data coming from a JS-based graphing editor (think of a spiced-up version of this) in a Rails-based backend. We want to ...
-5
votes
2answers
142 views
It's safe to access to the database and querying from it directly if it's on the server side, if not what should i do? [closed]
I made WPF application for a client-side and hosting database in a server side ,
I know there is something called REST API to transfer data between a client and server
I don't know this method and ...
1
vote
2answers
108 views
securely store credentials for an unsecure API
I'm writing a slack bot that interfaces end users with an API.
That API only method of identification is the raw "login:password" encoded to base64 (it doesn't answer back a token) ...
Currently in ...
1
vote
1answer
88 views
Creating a web portal to access multiple databases (security and best practice?)
I am looking to create a website.
There will be a portal, from which the user (and thier associated users) can create/access one or more databases. There will be many different databases in the ...
3
votes
2answers
117 views
Securing an API key in a web extension
I'm building a web extension that will be a wrapper for a public API. There aren't any paid tiers for the API currently, but I'm trying to secure the API key so it doesn't get stolen and used outside ...
