Questions tagged [security]

For questions relating to cryptography and IT security. This can be computer, network, or database security.

Filter by
Sorted by
Tagged with
-1
votes
1answer
78 views

Does Policy-Based authentication remove refactoring security?

I understand Role Based Security. I have read about Policy Based. I have read what others call Activity Based. What I want to know is if I do Policy-Based, am I avoiding what Role-Based requires and ...
4
votes
2answers
316 views

Isn't it unsafe that any program can access cookies of a browser?

For example, for Firefox the cookies are kept as an SQLite DB in user's folder. Any program can read these cookies. So, for example, can't an .exe program read the contents of a cookie and pretend to ...
1
vote
0answers
147 views

CORS headers for non-200 HTTP responses

I'm specifying an API for a REST service. The REST service will be primarily accessed by web browsers using XHR requests running code hosted from remote origins. Therefore, I'll need to add CORS ...
-2
votes
2answers
45 views

Security of data viewed and altered by a web app

I am working on a system that needs to keep the data safe and not accessible to people without authorized access. The client is a web app that communicates with the servers via APIs. This is what I ...
0
votes
1answer
263 views

Shall I use low quality insecure software if I'm asked to?

I work for a finance startup managing the technical stuff. The COO decided to create a new web site using a contract developer and the owner of the company paid for it ($9k). I'm asked to use the new ...
3
votes
3answers
640 views

securing database username and password in a web framework

In most web application which deals with a database, one has to enter the DB creds in a settings or config file, like DATABASES variable in settings.py in Django. What is the general practice to ...
1
vote
1answer
407 views

encrypting a string with public key in client side and decrypt it in backend using private key

I have a client side android app which needs to send an encrypted string to a server implemented in PHP. For this I have chosen an asymmetric algorithm (RSA). Should I: Save a public key in client ...
0
votes
2answers
90 views

How generate an anonymous (even for system administrator) identification number from a non anonymous identification number

Premise: I'm asked to develop a system that will trace sensitive data. The data are gathered by an intermediate operator (let's call him IO) on an office terminal. The final user (EU) will show up to ...
4
votes
1answer
2k views

Is sending username via custom HTTP header good idea?

I have a route in a RESTful API where I need to pass a single username (email address) but not password. The route is designed to have GET method, so my options are either query parameters or a custom ...
2
votes
1answer
118 views

Password policy compliance design

We're trying to build a solution where we have a requirement to check password compliance of a user with respect to all the systems that he has to. For example, if system 1 mandates that password ...
13
votes
1answer
738 views

Should microservices be users?

We are trying to determine the best way to authorise users in a microservice architecture, while ensuring microservices have limited permissions. Our architecture uses a central authorisation service ...
1
vote
3answers
123 views

using incremeting primary keys on real world data

Is it bad practice to use an incrementing primary key to refer to a real world field, such as an id number for an employee? Suppose that 1 is a valid id number for an employee. I am really tempted to ...
11
votes
1answer
439 views

During account creation, is it better to generate the password automatically and send it to the user, or to let the user create his own password?

This question came up today while discussing with a colleague about the 'create account' page for the website we're working on. My colleague's opinion is that we should make the registration as quick ...
0
votes
1answer
56 views

Checking permissions with multiple database calls or in stored procedure?

I'm developing an APP that has a API and a database that holds user permissions and user projects, among other things. Certain stored procedures must be protected, and for that I have to check the ...
1
vote
2answers
214 views

Is the length of a 'salt' a safety factor?

I'm trying to develop a small solution with the possibility of user authentication. Because this will be later hand over to other developers, i want the first iteration of the solution secure as ...
-2
votes
3answers
193 views

Is authentication equally important to encryption?

I am thinking how to implement the login of a new web application and as I search the net, most search result as about authentication instead of encryption. Assumption: The web application is ...
0
votes
2answers
85 views

Validating requests to API have come from a valid source

I am currently working on a project where I am developing a library which will do HTTP POSTs to a backend service on my server. The data that the backend service receives is processed and stored in a ...
22
votes
1answer
523 views

What is best practice for handling PRs addressing security vulnerabilities in public repo?

How should an open source project with a public repository best handle pull requests (PRs) that address securely reported but not yet publicly disclosed security vulnerabilities? I'm involved in an ...
1
vote
0answers
48 views

How should I handle private key in decryption worker?

I own the development of a Sidekiq worker that decrypts thousands of gpg encrypted CSVs and loads them into the database. While not necessary, I'm using a gem to interact with the gpg/GnuPG binary. ...
0
votes
2answers
131 views

Should I use unknown code from a third party? [closed]

I am looking to build and host a website for a client. Their existing site has a facility that allows customers to make donations and they want the new site to have it too. My manager has told them ...
9
votes
1answer
9k views

Difference between 'aud' and 'iss' in jwt

I want to implement a more robust authentication service and jwt is a big part of what I want to do, and I understand how to write the code, but I'm having a little trouble understanding the ...
0
votes
1answer
111 views

Programatically normalizing role based security systems

Role based security is a very common model for software nowadays. It is very powerful but requires careful configuration to leverage the benefits of shared roles. It is easy for a mess to be made for ...
0
votes
3answers
153 views

Handling one-user-only applications

I am planning creating a small personal blog application that handles only one user - the content author, let's call that user admin. There would not be any registration option, only a hidden login ...
-2
votes
1answer
70 views

How to let users send to a link

I'm building for a client's service that allows developers to build client side forms, similar to formspree.io, etc. Basically, developers can set an action to their HTML forms which send the POST ...
-2
votes
1answer
55 views

Web API interacting with local application [closed]

Situation I have a Desktop Application and a Web Application. I need the 2 to interact with each other. Such though that when a button is clicked on the Web App the Desktop App activates and ...
0
votes
1answer
178 views

Best practice to send data to webhooks without multiple redirects

I’m building a payment system for some ebooks with Reactjs on the frontend, Firebase as hosting and database and cloud functions at the backend side. Customers don’t need an account to buy ebooks so ...
3
votes
5answers
186 views

Do you integrate and compile User Authentication and Authorization code from the beginning of your project?

This is specifically about when to develop and implement code for authentication and authorization. I do not mean things the developer should be aware of such as exploits or using Prepared Statements ...
7
votes
5answers
7k views

What approach to use to prevent multiple requests to API which is exposed to public

I have an api where visitor can send an email through subscription: /api/subscribe To prevent massive load due to public exposure, how can I secure this endpoint? Do I have to use database or can I ...
2
votes
3answers
795 views

OAuth2 overkill for small business

I'm currently in the process of writing an API that will interact with a web application, iPhone app, and Android app for my work. The API is pretty simple and deals with pilots and their ...
4
votes
1answer
3k views

How to manage environment variables in local development

I'm in the process of writing a development philosophy document for a small groups of developers (6.5 developers to be specific), but it's ideally a document that will set down the company's best ...
1
vote
1answer
1k views

How to prevent users from decompiling app to find API key?

I'm currently building an Android app that uses OAuth to sign in to a service. With OAuth, I need to provide a client ID and a client secret to the service so it can identify my app. Right now, I'm ...
1
vote
0answers
245 views

User registration web service

I'm planning on making a web app that'll use MySQL as the database, Java/Grails as the backend and JavaScript/VueJS as the frontend and then they'll communicate using only RESTful JSON APIs (that way ...
0
votes
1answer
71 views

Risk Analysis in Open Source Community Driven Projects

I'm looking for perspectives on how risk analysis is performed when there's not precisely a "dollar value" associated with the risk, as in an Open Source project. Traditionally, risk analysis takes ...
8
votes
1answer
3k views

Token-based authentication using access and refresh tokens

I am implementing a token-based authentication system for a REST API using a short-lived access token and a long-lived refresh token. This is an abstract overview of the relevant API endpoints (HTTPS ...
0
votes
1answer
80 views

Security concept for a wiki-like application

I created a wiki-like application. Currently, there is no security, so all the contents have "edit"-buttons where the user can edit everything. Now, I want my application to have a public read-only ...
0
votes
1answer
408 views

safely executing arbitrary code

I have a program that can get code from a user as input (This question is language-agnostic, though I am primarily interested in answers for Java and Python). Usually, this code is going to be useful, ...
2
votes
0answers
261 views

When designing an activity-based authorization system, how should additional conditional checks be handled?

When designing an activity-based authorization system, how should additional conditional checks be handled? For example, I have the following authority: VIEW_COMPANY_TRANSACTIONS which allows the ...
-6
votes
4answers
224 views

AI Language that doesn't release source code or can't be decompiled

I looked at using python for the AI in a security application for hobby-business but apparently you either release it as source code or it can be easily decompiled. Of the new machine learning ...
1
vote
2answers
124 views

What ways can a system in which users log in with a PIN be compromised?

I am tasked with implementing a web-based gambling system that's operated on site. The requirements given to me by the company co-founder and designer for user login give red flags in regards to ...
3
votes
5answers
995 views

Should I encrypt mobile number and otp when sending to backend

I have a login page, where user logs in via his mobile number, He gets an OTP send via backend server, once he enters a One-Time Passcode (OTP), we hit an API like this: https://backend.com/api/login?...
0
votes
1answer
118 views

What are the options to guarantee that a client that's connecting to a server is really who I think it is?

I have a proxy server that talks to a bunch of services and I want to have a way to prove to servers behind the proxy they are actually receiving a request from the proxy server and not from something ...
0
votes
3answers
97 views

What should I be aware of when allowing user comments on my website?

I have a portfolio website and i'm planning on allowing comments as a sort of "guestbook" feature. What are some things i should consider before starting? I don't want to get screwed over by a ...
0
votes
1answer
555 views

Is it possible to secure a REST API and validate the integrity of each requests?

I am trying to design a public facing website and would like to experiment with a WebAPI backend and one of the popular front end javascript frameworks. Now, this application is not going to require ...
2
votes
1answer
1k views

How should I secure Adminer for production use?

I'm developing an enterprise web application, hosted on site and managed by the corporate IT team. I do not have remote access to the server, and the only way in is through the web interface. I'd like ...
0
votes
2answers
128 views

Deployed Website's Integrity

Yesterday, the deployment of a financial website on a client was replaced with an older version which created unexpected issues and a downtime of almost 12 hours. We came to know that two guys from ...
1
vote
3answers
171 views

How do I secure downloadable data so that it cannot be exploited easily?

I'm developing a web application which stores sensitive information, which the user can access after a check that I built. This function then returns a download url to the user which leads to the FTP ...
2
votes
1answer
121 views

Securing an HTTPS endpoint for non-browser Post requests

I have a set of machines that I'm going to setup to push data to my web server over HTTPS at regular intervals. These units will automatically send requests using a script, so I plan on giving them ...
3
votes
1answer
84 views

How to ensure privacy on a remotely hosted server?

If I have written a privacy tool as a .NET web application which is to be hosted on a commercial hosting site, other than hosting it in a privacy friendly country, how can I assure users that the ...
2
votes
1answer
483 views

Can a third party service rely on JWT for authorization

I am using JWT for authentication in a micro service architecture. There is 1 UI web app and multiple REST API exposed services in the backend. I am considering a IAM service which will give a JWT to ...
4
votes
2answers
1k views

Is exposing a public API that calls a private API a good practice?

This is more about architecture question. I will be developing microservice in Lumen or Slim, it will not be accessible from the public. The private microservice will be dealing private stuff. ...