All Questions

Tagged with
Filter by
Sorted by
Tagged with
3
votes
1answer
211 views

Does it make sense to authenticate a method that exposes non-sensitive data

We're developing an Angular application that consumes a web method exposing some information that is not sensitive, just bus seat promotions; the user enters where he wants to go and when and he will ...
1
vote
1answer
204 views

Breaking 3-tier architecture into multi-tier architecture

Recently I have been working on a rather large system with Vue.js for a single page app (SPA) and an API for the backend. The customer is concerned with the security, performance and maintainability. ...
-1
votes
1answer
26 views

How to implement linkedin authentication/data sharing with multi party?

Hi I am working on application 2. My application interacts with application 1 and 3. Clients of application 1 need to be to share their linkedin profile information with application 3. I have ...
1
vote
1answer
37 views

Architecture for a secure server control panel

Currently I am working on an open source server control panel similar to cPanel, Plesk but I am not sure what would be the best approach to make system changes which require root permissions. I was ...
4
votes
2answers
1k views

Is exposing a public API that calls a private API a good practice?

This is more about architecture question. I will be developing microservice in Lumen or Slim, it will not be accessible from the public. The private microservice will be dealing private stuff. ...
3
votes
1answer
112 views

Designing a secure system that verifies the person registering a product is the end-user/customer

The scenario: Our customer creates physical devices used in infrastructure across the globe Their new devices have IoT capabilities and can communicate their status and other sensor data to the cloud ...
4
votes
1answer
1k views

API Gateway security (for microservice architecture)

we have started with microservices recently, but we have some problems with implementing the Security layer. The idea is that the request comes to Gateway, the Gateway looks to authorization header, ...
2
votes
1answer
769 views

Do Non-Functional Requirements for Security make sense for defining SDLC?

I recently had engaged in a security discussion with my companies cyber security risk lead, discussing security controls and standards they would be holding the project to. The expectation of the ...
4
votes
3answers
4k views

How to store uploaded client documents securely in webapplication

A small company without any IT skills wants to run a web application where customers can enter various bits of data and upload pdfs. The documents regard product specifications and have to be kept ...
0
votes
1answer
86 views

Universal Form Handler

I'm building a API that gets called from web / mobile applications written using Ionic (web languages on mobile), which uses Angular.js. We want to be able to do server side validation of forms but ...
3
votes
1answer
202 views

Using SMS as transaction in offline situations

Currently, I have this hybrid mobile application which talks to my C# web service to do CRUD transactions. As the mobile application is always on the go, and there might not have internet connectivity ...
1
vote
2answers
150 views

Architecture supporting digitally signing of tons of soap requests [closed]

What is the optimal architecture for such case: Web application(.Net Web Forms) connects to third party web service via wcf. Third party web service accepts only digitally signed soap requests Some ...
3
votes
1answer
288 views

Identity propagation using Azure service bus

We currently have a platform with a SOA architecture in which the user's identity is propagated from the web application via middle tier services (REST and SOAP) until we actually query our data ...
0
votes
0answers
419 views

Passing Data Between Tiers in 3-Tier Architecture

Assuming we are talking physical tiers, my understanding is that in order to pass data from say the data tier to the business logic tier the JSON format is used (or XML), so say I have an ORM (...
2
votes
1answer
575 views

NodeJs website webapp architecture

I would like some advice on how best to architect a website comprising the following: tool a landing page, open to the public, main marketing tool the main website/app, that people can access only if ...
0
votes
1answer
157 views

Do we have any special design considerations for maintaining anonymity in an application?

This is an open-ended question which I am analysing while doing some fun projects in leisure. Websites like Google, Facebook do store user activities and perhaps sell them or use them for ...
1
vote
1answer
1k views

Is it an implementation of a stateful mechanism for Rest API authentication?

In many articles about Rest API's best practices, it is recommended to not depend upon sessions on server side since it leads to a stateful mechanism. I currently use Play 2.2 framework, with a ...
2
votes
2answers
226 views

Principles of an extensible data proxy

There is a growing industry now with more than 30 companies playing in the Backend-As-A-Service (BaaS) market. The principle is simple: give companies a secure way of exposing data housed on premises ...
1
vote
1answer
216 views

How to securely store user credentials from external website

I'm developing an application where I'd like to use credentials from external websites. This will be used to login with the website API and get information for the user. Example: I want to use the ...
28
votes
1answer
1k views

If the spec is flawed, should it still be followed?

I have been assigned to develop an integration to one of my employer's applications to an external system developed by our client. Our client's specification for the integration that has some blatant ...
4
votes
2answers
2k views

Where to Perform Authentication in REST API Server?

I am working on a set of REST APIs that needs to be secured so that only authenticated calls will be performed. There will be multiple web apps to service these APIs. Is there a best-practice approach ...
5
votes
3answers
5k views

Is there a better way of handling access control logic instead of it being in the UI?

Through most of my dev experience, I've never had to deal with much variety of access control architectures. They've all been pretty straight forward: Group [Create, Update, Delete] - User 1 ...
0
votes
4answers
229 views

Are security exploits a fatality? [closed]

I'm asking this here and not on the security related site because this one is a question about "software architecture" and "development methodologies", which are both covered by the FAQ. EDIT: I'm ...
3
votes
1answer
298 views

Building dedicated codepad in PHP

I am author of growing framework, which is focused around User Interface building in PHP. Essential requirements for the up-coming website redesign is ability to run code examples. I am willing to ...
1
vote
1answer
95 views

Securely changing system configuration from a web application

I need to write a web application that acts as a configuration interface for some system services. Meaning it will probably change some kind of configuration file and has to restart (linux) system ...
61
votes
15answers
17k views

Is there any reason not to go directly from client-side Javascript to a database?

Possible Duplicate: Writing Web “server less” applications So, let's say I'm going to build a Stack Exchange clone and I decide to use something like CouchDB as my backend store. If I use their ...
3
votes
3answers
3k views

Securing credentials passed to web service

I'm attempting to design a single sign on system for use in a distributed architecture. Specifically, I must provide a way for a client website (that is, a website on a different domain/server/network)...
5
votes
2answers
1k views

Should I be using a JavaScript SPA designed when security is important

I asked something kind of similar on stackoverflow with a particular piece of code however I want to try to ask this in a broader sense. So I have this web application that I have started to write in ...
3
votes
4answers
603 views

Public-private key pair handling on a Windows ecosystem

I've been thinking about how to architect an infrastructure for one of our business applications with the following requirement: Data written by some user can only be read by that user and his ...
0
votes
1answer
213 views

Security aspects of an ASP.NET that can be pointed out to the client

I need to write several passages of text in an offer to the client about the security layer in ASP.NET MVC web solution. I am aware of security that comes along with MVC 3 and an improvements in MVC ...