All Questions

Filter by
Sorted by
Tagged with
-1
votes
2answers
262 views

How to process a login form data?

I have created a login form for my website, but the issue is how to process the data provided in the form by the uses. You see, I can't just write a basic function like this one - myfunction(){ if(...
1
vote
2answers
64 views

Securing e-commerce administrator panel with a VPN

I am developing the back-end of an e-commerce system, which has customer and administrator type accounts. These two roles do not overlap, administrators are there to do the back office work, while ...
0
votes
3answers
178 views

How far do you go in server-side validation of POST/GET requests?

Our application had a few vulnerabilities detected by AppScan and we had to add server-side validation to catch SQL injection attempts. But my question is, how far do you go in server-side ...
6
votes
2answers
438 views

How do you handle JWT expiration for long running calls?

Currently we are debating over securing our multiple micro-services. The major concern is that the JWT token provided to us will expire before the call is finished. (This is in the synchronous design) ...
-2
votes
1answer
69 views

How to let users send to a link

I'm building for a client's service that allows developers to build client side forms, similar to formspree.io, etc. Basically, developers can set an action to their HTML forms which send the POST ...
0
votes
1answer
547 views

Is it possible to secure a REST API and validate the integrity of each requests?

I am trying to design a public facing website and would like to experiment with a WebAPI backend and one of the popular front end javascript frameworks. Now, this application is not going to require ...
0
votes
2answers
128 views

Deployed Website's Integrity

Yesterday, the deployment of a financial website on a client was replaced with an older version which created unexpected issues and a downtime of almost 12 hours. We came to know that two guys from ...
0
votes
1answer
2k views

How can I safely expose web API endpoints for user-private data?

I'm building a web application wherein users CRUD their own private data. Can I safely expose API endpoints? Despite years in-industry and endless web-research, I'm not clear on the best ...
3
votes
2answers
255 views

How do services that rely on client-side access to an API or data consumption endpoint prevent abuse?

For example, web application monitoring services like New Relic RUM or Bucky use JavaScript to collect data on a user's session and eventually send that data back to an endpoint. For New Relic, the ...
0
votes
1answer
80 views

Extensible web application where users can upload client-side code

I have a simple web application built with Angular which fetches some state from a web server and shows it to the user. Additionally I want to implement a feature where users are able to customize the ...
4
votes
1answer
979 views

Postgres roles for website users

I am setting up a PostgreSQL database with a very small number of tables for a simple website. I am looking at ways to make it as solid and auditable as possible. Is there any particular reason why ...
1
vote
3answers
923 views

Javascript Password Security [closed]

I am having difficulty with the answer provided here, but I couldn't understand how to implement it. My code is pretty much identical: <script language="javascript"> function check(form) { ...
1
vote
2answers
220 views

Security and sanitizing user-input with limited control over 'output' targets

I have recently joined a team working on an application with an integrated chat system. It is a standard chat system that allows clients to communicate, with messages routed through a central server. ...
1
vote
2answers
155 views

How much should I concern myself with hiding the IDs of my database in URLs?

I keep coming across questions and articles on the internet suggesting that it's not a good practice to have the IDs of your database records visible to the public. Yet I've never taken it seriously ...
0
votes
1answer
80 views

How Do I Securely Edit a Database Entry Based On ID in an Admin System?

This is more of a conceptual question because the way that I am doing it would be secure enough for my purposes (educational). I created a simple admin panel that displays a stock picks database as ...
3
votes
1answer
85 views

Web application security: Need a 2 phase check?

(Is this the best forum for this type of question?) I'm writing a web application which allows approved users to login, and perform various tasks, depending on the security role(s) they have been ...
1
vote
1answer
754 views

Should I hide certain HTTP status codes?

So I have different seniors taking different positions on this. Some saying hide nothing, those codes are there for a reason. Others saying to hide most status codes, reducing the number to a much ...
1
vote
1answer
1k views

Anonymous access to api REST, protection

I have a public website that does not require authentication. It's a lighting calculator for indoor cultivation. Anyone can enter and complete the process and ultimately save your settings for future ...
0
votes
2answers
367 views

secure offline PC storage accessible through javascript

I'm attempting to build a browser-based HTML5 application that has the ability to store data locally on a PC (not mobile device) when offline. This data is sensitive and must be secure. Of course the ...
6
votes
4answers
10k views

How to store Role Based Access rights in web application?

Currently working on a web based CRM type system that deals with various Modules such as Companies, Contacts, Projects, Sub Projects, etc. A typical CRM type system (asp.net web form, C#, SQL Server ...
2
votes
1answer
315 views

What are security advantages of Google Caja over using the web worker API? [closed]

I am currently looking into Google Caja to run user-supplied JS code in the browser and in Node. So far, I understand, that, in a browser context, "cajoled code" disallows reading and messing with ...
2
votes
1answer
1k views

How important is an SSL certificate for a internal website?

I know many people have asked the same question but I think it really depends on the type of the website. So that's why I am asking the question about my website. I am developing a PHP web ...
22
votes
5answers
8k views

How do web servers enforce the same-origin policy?

I'm diving deeper into developing RESTful APIs and have so far worked with a few different frameworks to achieve this. Of course I've run into the same-origin policy, and now I'm wondering how web ...
1
vote
2answers
211 views

How can I limit access for automatically generated files to specific users in a MVC setup?

I have a typical MVC based website, and I'd like to give some registered users the abillity to extract data from the database (in a variety of formats). The workflow is very simple: User logs in, ...
0
votes
3answers
1k views

How can I secure a request handler so I only respond to the correct clients?

Here's the scenario... I have a web site that has a generic handler written in asp.net (.ashx file) that accepts http requests, gets relevant data, converts the result into xml and then passes that ...
1
vote
3answers
188 views

Protect Images in a Webpage

I want to build a website that will contain a lot of images. I don't want users who visit the website to be able to save the images. I have blocked the right click option, but is there any other ...
7
votes
5answers
2k views

How can I keep a production Python environment secure?

Most of my work is creating websites in Django (a Python web framework) and deploying them to my own or clients' servers. I work from a virtualenv to separate site from system packages and have ...
38
votes
4answers
4k views

Logging failed login attempts exposes passwords

I started logging failed logins attempts on my website with a message like Failed login attempt by qntmfred I've noticed some of these logs look like Failed login attempt by qntmfredmypassword I'm ...
11
votes
3answers
14k views

Securely storing secret data in a client-side web application

I have this web application that is going to be all client-side technology (HTML, CSS, JavaScript/AngularJS, etc...). This web application is going to be interacting with REST API in order to access ...
4
votes
0answers
2k views

Connecting with OAuth, dealing with logout and browser sessions

I work on a open-source web application (Moodle) which connects to a number of external services such as Google Drive, Dropbox etc. to allow users to exchange files with these services. Primarily we ...
10
votes
7answers
1k views

Is the use of security conditionals in a view a violation of MVC?

Often what's displayed to a user (e.g. on a web page) will be based partly on security checks. I usually consider user-level / ACL security to be part of the business logic of a system. If a view ...
2
votes
4answers
507 views

What are the downsides of leaving automation tags in production code?

I've been setting up debug tags for automated testing of a GWT-based web application. This involves turning on custom debug id tags/attributes for elements in the source of the app. It's a non-trivial ...
-2
votes
3answers
336 views

How to handle security of temporary data on web server?

I'm primarily an ASP.NET developer but this question really applies regardless of language. So obviously it is a good idea to prevent external attacks that arise from session hijacking and csrf ...
0
votes
2answers
232 views

What is the logic behind filtering/sanitizing input?

I have always found it more logic to validate input instead of filtering it. How to appropriately filter data depends on the situation, so IMO it should be done in output or when saving to a database. ...
3
votes
1answer
152 views

File Upload Forms: Security

SO I'm building an application for uploading files. We're paying scientists to contribute information on pests, diseases and bugs (for Plants). We need the ability to drag and drop a file to upload it....
8
votes
1answer
9k views

How frequent should the Token Updation in CSRF security be?

To start with the background, this post is what Jeff Atwood says about CSRF tokens. In this very page, he goes on to say: An even stronger, albeit more complex, prevention method is to leverage ...
4
votes
2answers
1k views

Making sure database connection information is secured

This is the first time that I am working on a web application. I was going through the question What technical details should a programmer of a web application consider before making the site public? ...
-1
votes
1answer
2k views

python login form vulnerability?

<HTML> <HEAD><TITLE>Login Page</TITLE></HEAD> <BODY> <CENTER> <FORM method="POST" action="http://yourserver/cgi-bin/login.py"> <paragraph> Enter ...
4
votes
2answers
1k views

Is a traditional client app which connects directly to a database a good idea?

After using Django's excellent admin interface, I was pondering creating a similar system which wasn't as tied to an ORM. Now, while considering this, I thought that overcoming webapps limitations (...
14
votes
3answers
10k views

Is it a good practice set connection strings in a web config?

Recently I have a discussion with some of my colleagues at my work because they said that it's better have in a .DLL a string connection encrypted. And I said why just don't use the string connection ...
5
votes
6answers
3k views

How can I prevent users from creating multiple accounts on a web site?

I'm building a site that needs to guarantee user reputation scores are accurate by preventing users from creating more than one account, at the cost of decreased user signups. So far, the only ...
4
votes
2answers
253 views

Why should you prevent a search engine from indexing your development server?

I've heard that you shouldn't let search engines index your development server. The reasons given were: Duplicate content penalties Customers making purchases from an unsecured domain (if eCommerce) ...
0
votes
5answers
521 views

Hiring Developers - Securing Source Code [duplicate]

I have a popular web-based app, and now suddenly my main developer has disappeared. Although I've found other great developers but I don't want to distribute the source code to everyone. Is there any ...
33
votes
4answers
6k views

Should MVC/REST return a 403 or 404 for resources belonging to other users?

When working with a resource-based site (such as an MVC application or REST service), we have two main options when a client tries to GET a resource that they don't have access to: 403, which says ...
27
votes
5answers
16k views

What best practices should be employed in a PHP login script?

I am wanting to re-write my login scripts for clients websites to make them more secure. I want to know what best practices I can implement into this. Password protected control panels are in their ...
-1
votes
7answers
570 views

My very first serious project and I'm concerned about security [closed]

I'm making a small social networking web site for a specific university's students (where I study) and I'm concerned about security (access to the database). What should I do? What I have to check for ...
12
votes
1answer
7k views

Software architecture for authentication/access-control of REST web service

I am setting up a new RESTful web service and I need to provide a role-based access control model. I need to create an architecture that will allow users to provide their username and password to get ...
3
votes
4answers
366 views

How did you learn about security in your web development?

I've been developing intranet web sites and public web sites with no big issues concerning security. There were nothing to steal and nothing to gain. Nothing to attract people to try to reach the ...
7
votes
7answers
2k views

How to make security usable in a web application?

I'm in the planning stages of developing a web application that I want to make as secure as possible. I'm pretty clear about how to do that from a technical point of view, but there is one massive ...