We’re rewarding the question askers & reputations are being recalculated! Read more.

Questions tagged [security]

For questions relating to cryptography and IT security. This can be computer, network, or database security.

50 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
6
votes
1answer
731 views

Directly query database vs. Using web service

I'm a junior programmer, am working on a WPF application that will deploy to ~50 users. We basically are streamlining all of his charting/tracking of client data. Each user will probably make about ...
4
votes
0answers
152 views

Client Browser, Node Server, Web API auth structure

I have a web API that accepts Authorization headers to allow access. It responds with the requested data in addition to setting a session cookie. Subsequent requests can be made with no auth headers ...
4
votes
0answers
2k views

Connecting with OAuth, dealing with logout and browser sessions

I work on a open-source web application (Moodle) which connects to a number of external services such as Google Drive, Dropbox etc. to allow users to exchange files with these services. Primarily we ...
3
votes
0answers
267 views

When designing an activity-based authorization system, how should additional conditional checks be handled?

When designing an activity-based authorization system, how should additional conditional checks be handled? For example, I have the following authority: VIEW_COMPANY_TRANSACTIONS which allows the ...
3
votes
0answers
105 views

Windows Phone 8.1 & above - is there some equivalent for Apple's keychain

I want to store store some app specific secret on the phone - this should be available only for the app & no other app. I was looking at DPAPI - however, if the user does not have a logon ...
3
votes
0answers
94 views

How to limit users of a service to a specific program

I have built an android game - I would like to add a "high score" leaderboard to it, such that people can show off how high they managed to score. How should I design it so that people can't "hack" it ...
2
votes
2answers
167 views

Wrapper Class Should be made static?

I am planning on creating a wrapper class in c# which will call cryptographic functions provided by .Net Framework, just to make sure I am clear, I am not writing any cryptographic algorithm, just ...
2
votes
0answers
55 views

Securing a microservice that will be accessible from frontend

I need an advice on securing interaction between an application App and a microservice RecordApp. App is the main application, where all users are registered and do some activity. RecordApp is a ...
2
votes
0answers
73 views

What's the best way to control distribution/usage of proprietary, internal software?

I was tasked with writing software for my company. As I am now writing a third program (with many more coming), what's the best way to control the distribution/usage of our software? The software I'...
2
votes
0answers
157 views

RSA Private key renewal - How often?

Let's say I am using a RSA keypair to encrypt and decrypt a large amount of traffic over a public network. Assume all traffic is padded and the key is 2048 bits, how often would you recommend renewing ...
2
votes
0answers
314 views

Handling permissions in a MVP application

In a windows forms payroll application employing MVP pattern (for a small scale client) I'm planing user permission handling as follows (permission based) as basically its implementation should be ...
2
votes
0answers
116 views

Switching between Azure Mobile Services vs my own implementation. Will UIDs change?

I'm looking at Azure Mobile Services, particularly the Authentication part (which I believe relies exclusively on OAUTH 1 or 2). I want to make sure that my application isn't tightly coupled to the ...
1
vote
0answers
119 views

How to store relational data belonging to different client customers?

My users will be businesses with a small number of accounts each: e.g. Business #1 with 3 users, Business #2 with 5 users, etc. I am trying to determine the best way to organise the relation (on ...
1
vote
0answers
132 views

Is my microservices architecture in line with best practises? (STS/SPA/Frontend API/Backend services)

My goal is to make an application with a SPA front end that updates in real time, incorporating microservices architecture (and for solutions CQRS design patterns and eventing with Azure Service Bus). ...
1
vote
0answers
163 views

Storing File URI and Checksum to check if the file was changed in future

right now application is storing a file data in database and we are considering instead to store a link (http, ftp, etc) to the file and its checksum. We will only provide a service and the service ...
1
vote
0answers
248 views

Front-end-side encryption: Where to store password throughout session?

currently we're working on a small application where we store a bunch of JSON data coming from a JS-based graphing editor (think of a spiced-up version of this) in a Rails-based backend. We want to ...
1
vote
0answers
149 views

CORS headers for non-200 HTTP responses

I'm specifying an API for a REST service. The REST service will be primarily accessed by web browsers using XHR requests running code hosted from remote origins. Therefore, I'll need to add CORS ...
1
vote
0answers
48 views

How should I handle private key in decryption worker?

I own the development of a Sidekiq worker that decrypts thousands of gpg encrypted CSVs and loads them into the database. While not necessary, I'm using a gem to interact with the gpg/GnuPG binary. ...
1
vote
0answers
247 views

User registration web service

I'm planning on making a web app that'll use MySQL as the database, Java/Grails as the backend and JavaScript/VueJS as the frontend and then they'll communicate using only RESTful JSON APIs (that way ...
1
vote
0answers
293 views

How to create a licensing system for a software

I'm building a chrome extension that I would like to offer for free for a given trial period and then the users buys a registration key on our website for a forever version . I've built software ...
1
vote
0answers
45 views

Securing an Azure Service Bus topic and subscriptions

We are working on a solution that will publish messages on an Azure Service Bus topic but we don't know yet which other team or even third party might be interested in subscribing to those messages in ...
1
vote
0answers
47 views

Correlating Search Classifiers in a Database Scan for Sensitive Information

Problem Description I am working on an enterprise data discovery project that is designed to scan databases for sensitive information. The basic search unit is called a classifier and covers things ...
1
vote
0answers
634 views

Generate a fixed length number hash from a number

Let say I've a fixed length number, e.g. 6 digit: 837493, I want to apply some process (with a salt), and generate a new number of another 6 digits, e.g. number = 837493 another = hash(number + ...
1
vote
0answers
143 views

'HMAC style' design example for a shared secret

I'm looking to secure an API based on a shared key and a given username and datetime. The API gives access to trusted third parties and does not require the input from a user in order to access their ...
1
vote
0answers
300 views

How to validate information on server without using database or session

Each user has multiple sites they can access reporting data for in an application I am working on. To prevent having to go to the database on every single request, I validate that they have access to ...
1
vote
0answers
47 views

Online error reporting without network access

I have developed an application for android requiring no permissions, but the biggest downside of this is that I don't have error reporting. So, I was playing around for the past week with any ...
1
vote
0answers
82 views

Domain security involving domain logic

Together with my application's domain logic I am trying to outline the security model. I am stuck with a requirement that prevents me from considering security just a cross-cutting concern over my ...
1
vote
0answers
197 views

Validating time-limited HMACs

I'm exploring using HMAC style secret-key authentication with timestamp expiry, but am struggling to get my head around how you validate the timestamp portion. On the client side you would do: ...
0
votes
0answers
55 views

What is the correct way of setting and then differentiating between paid and free user in Firebase / Firestore?

I am developing a mobile application that will have both free and paid versions. The way I see how I could differentiate between what is a paid and free user is to set a property isPaid on their ...
0
votes
0answers
47 views

Prevent token sharing: chained single-use tokens VS a designated invalidation feature

Situation: A Client is requesting a resource from a Host multiple times, usually with minutes or hours between requests. The Client has a signed, verifiable token, which we'll call a Receipt, that ...
0
votes
0answers
23 views

Save user credentials for use with multiple third-party websites

I've seen a few similar questions but nothing to address this exact issue... I'd like to have a mobile app that allows users to input username/password once and then be automatically logged in with ...
0
votes
0answers
17 views

W3C Reporting API - Mitigate spam/forged reports

I'm looking into the W3C Reporting API, which enables websites to instruct the client (browser) to send reports about: browser crashes, network errors, browser interventions etc. ouside the JS ...
0
votes
1answer
51 views

How to prevent angular 2 client from accessing privileged fields

I'm learning angular and have been reading about various backend solutions like direct db access, REST, and graphql. One thing I haven't seen addressed anywhere yet is how do you protect privileged ...
0
votes
0answers
10 views

Open ID Connect Session Management Access/Refresh Token vs Session iFrame

We have a web app in which we allow users to log into the app using any Open ID provider(e.g. Okta, Google, Facebook etc.). We want to implement the correct Open ID Connect prescribed methodology/...
0
votes
0answers
34 views

How to restrict API endpoints which are deployed in AWS Application Load Balancer?

I created one webapi application which includes few modules like account, user etc and overall includes 10 or more endpoints. I deployed this in EC2 instances and configured in application load ...
0
votes
0answers
39 views

Which OAuth2 Flow?

I'm just getting into OAuth2 and I'm a tad confused (you've probably heard that before)! I am writing a small independent service which will expose a basic REST API enabling client applications to ...
0
votes
1answer
91 views

Custom ACL Implementation

I have been trying to figure out an ACL solution for my application which should manage API endpoint's access rights dynamically. Some said that I have an option of Spring Security ACL. I checked it ...
0
votes
1answer
533 views

Are there any JSON based notations for Access Control Lists? (Alternative to S-Expression)

I'm looking for a notation that is familiar to modern developers and can supersede s-Notation. (additional insight into Rivest's proposal of s-Expression is here) Is there any Swagger, JSON or other ...
0
votes
0answers
47 views

Client application and secure data exchange without ssl/tls

I have my own home server and port 80/443 is blocked from my ISP provider. I want to create a Qt gui application that saves my data on my server using REST (using port 8080 or something) using nginx/...
0
votes
0answers
39 views

Detecting web proxy security

Various online resources offer proxy lists claiming that they offer various levels of anonymity. I'm trying to find out how this can be programmatically tested. I suspect the answer lies in headers. ...
0
votes
0answers
433 views

Passing Data Between Tiers in 3-Tier Architecture

Assuming we are talking physical tiers, my understanding is that in order to pass data from say the data tier to the business logic tier the JSON format is used (or XML), so say I have an ORM (...
0
votes
0answers
100 views

Implement taxometer paywall

I need to add a paywall to my site. According to this article, I want to implement a taxometer system. The easiest and least secure way would be tracking the number of viewed articles using secure ...
0
votes
0answers
712 views

Security in Transversal Layer in Domain Driven Design

I'm building a solution based on Domain Driven Design, I'm trying to implement the security system (authentication, authorization, roles, system configuration, connection strings, etc..) in a ...
0
votes
1answer
303 views

Web page accessing local system via localhost HTTP API

I have seen this pattern that allows web pages to interact with local system resources through a HTTP interface and I have a couple questions about it: What is this pattern called? What ...
0
votes
1answer
377 views

Secure communication between a mobile app and a microcontroller

I have a MCU-based design that essentially controls other hardware and this MCU is controlled through an app. I was hoping someone could help me figure out how to secure this communication between the ...
-1
votes
2answers
967 views

External User ID to Internal User ID

There is an internal API, REST client over DB, all of which methods require User ID as parameter. User ID is an integer value - numeric PK in User table. Also there is an public API, that is like a ...
-1
votes
1answer
199 views

Cookie name security

Is it a security hole to name each session with the username of the user currently logged in? example: //Alice has login sessions_name('Alice'); sessions_start(); //Alice has login //When Bob Logs ...
-1
votes
1answer
27 views

How to implement linkedin authentication/data sharing with multi party?

Hi I am working on application 2. My application interacts with application 1 and 3. Clients of application 1 need to be to share their linkedin profile information with application 3. I have ...
-2
votes
1answer
52 views

Web Security (PHP) - Is it Secure to do downloading files & presenting with Headers to the End User ?

I have security question that i am not sure if this approach is safe and secure way to download a file and present to a web user ? We have customers invoice files stored in a server location (...
-3
votes
1answer
58 views

Protecting research source from spyware/data mining

My question is simple: What steps should you take to protect research from the vast amount of spyware or insecure applications on a given device? Background: I do research into developing new models ...