Questions tagged [security]

For questions relating to cryptography and IT security. This can be computer, network, or database security.

Filter by
Sorted by
Tagged with
2
votes
1answer
489 views

Can a third party service rely on JWT for authorization

I am using JWT for authentication in a micro service architecture. There is 1 UI web app and multiple REST API exposed services in the backend. I am considering a IAM service which will give a JWT to ...
4
votes
2answers
1k views

Is exposing a public API that calls a private API a good practice?

This is more about architecture question. I will be developing microservice in Lumen or Slim, it will not be accessible from the public. The private microservice will be dealing private stuff. ...
4
votes
3answers
364 views

Is my app version a sensitive information

To make maintenance and versions tracking easier, I would like to expose the app version of each of the applications I develop on all my environnements. Can the app version and the last deploy ...
1
vote
1answer
185 views

Secure delete a registry key

On a regular Hard Drive a secure delete of a file is possible by overwriting it, does simply overwriting the registry key is enough to secure delete the key ? If not how I can proceed to secure ...
0
votes
2answers
198 views

Multilayer security concept

I'm working on a security concept of a bigger project. It will be done with Spring,but that's actually not relevant right now. The whole system is a hierarchical tree of computer nodes that run a ...
0
votes
1answer
145 views

Using browsers to monitor changes in e-commerce pages

I've been looking at ways to monitor for changes in things like price and availability on e-commerce sites via visiting browsers, with three constraints: the sites often don't have much ongoing ...
2
votes
2answers
2k views

Should a backend Restful API implement data validation

I am working a project which involves back-end Restful API and single-page front-end app. I am wondering if the back-end API has to implement all sort of data validation logic , which is also to be ...
0
votes
1answer
146 views

What is the right way not to put passwords into end user program in java?

In the simplest form, our (near future) project consists of a end user program, that directly connects to databases and apis. This is obviously bad as then the end user program consists of sensitive ...
1
vote
1answer
1k views

Is it good idea to save user/password and get token from server automatically behind the eyes of the user?

Suppose I have a REST API backend and it is used by a mobile app. Authentication is based on tokens (JWT) with expiration time. Mobile app user does not want to enter credentials so often, even for ...
0
votes
1answer
2k views

How can I safely expose web API endpoints for user-private data?

I'm building a web application wherein users CRUD their own private data. Can I safely expose API endpoints? Despite years in-industry and endless web-research, I'm not clear on the best ...
3
votes
1answer
449 views

How can I be sure that an unofficially uploaded NuGet package is genuine?

I've come across a few cases lately where a package on NuGet has a name that starts with "Microsoft" but is actually uploaded by someone else. Take Microsoft.TestApi for example. Ostensibly this is a ...
1
vote
1answer
548 views

What are security risks of WYSIWYG HTML/CSS/JS editors running as web service?

I am currently implementing WYSIWYG editor that will be available on the web, what are the main security issues I should tackle? The editor currently works that when user is done typing, the text gets ...
2
votes
0answers
154 views

RSA Private key renewal - How often?

Let's say I am using a RSA keypair to encrypt and decrypt a large amount of traffic over a public network. Assume all traffic is padded and the key is 2048 bits, how often would you recommend renewing ...
0
votes
4answers
782 views

Why are computer systems still insecure? [closed]

After 50 years of software engineering, why are computer systems still insecure? I don't get it. Two questions: (i) What's so hard about just denying or restricting networked access to bad actors who ...
1
vote
0answers
264 views

How to create a licensing system for a software

I'm building a chrome extension that I would like to offer for free for a given trial period and then the users buys a registration key on our website for a forever version . I've built software ...
0
votes
2answers
231 views

Are all code signing certificates cross-platform?

I have an application, that can run on both Windows and macOS. I want to apply a digital signature to its binaries. I have already got a Thawte certificate (with private key) for Windows. Can I use ...
3
votes
2answers
907 views

How to validate ajax request comes from correct page and is not tampered with?

I am building a simple Q&A app with PHP, HTML and JS. I have three tables: users,question and answers, each table has it's own primary key and questions and answers both have foreign key ...
0
votes
1answer
127 views

Data structures and algorithms for event correlation

What data structures and algorithms are suitable for event stream correlation? Specifically, I am looking at these two use cases: X occurrences within t seconds grouped by some variables (v1,v2). For ...
-2
votes
3answers
244 views

Is there any way to build a tamperproof forum like Reddit? [closed]

Following the recent incident on reddit (viz https://www.reddit.com/r/The_Donald/comments/5ekdy9/the_admins_are_suffering_from_low_energy_have/dad5sf1/) where the CEO of Reddit changed content of ...
3
votes
2answers
256 views

How do services that rely on client-side access to an API or data consumption endpoint prevent abuse?

For example, web application monitoring services like New Relic RUM or Bucky use JavaScript to collect data on a user's session and eventually send that data back to an endpoint. For New Relic, the ...
3
votes
2answers
2k views

Managing session timeouts with regards to user activity in the page

So I will be creating a feature to a php application that does the following: Create a session that expires after 30 minutes. After 30 minutes, if there is no user activity in the application (...
3
votes
1answer
112 views

Designing a secure system that verifies the person registering a product is the end-user/customer

The scenario: Our customer creates physical devices used in infrastructure across the globe Their new devices have IoT capabilities and can communicate their status and other sensor data to the cloud ...
4
votes
4answers
221 views

How to prevent data-scanning via public API?

Our customer (a bank) needs to publish a web-service API for use by 3rd party applications. The security is going to involve OAuth2 and JWT (JSON Web Token). The problem is that the customer is afraid ...
2
votes
1answer
308 views

What is the purpose of a multi-claims-based authorization system?

I'm having a difficult time conceptualizing the purpose of a multi-claims-based authorization system. For example, ASP.NET MVC Identity allows for key-value pairs called claims that you can store on a ...
2
votes
2answers
689 views

How to keep track of maven dependency updates in projects?

How do you keep track of maven dependency versions? Let's say you are using version 1.0.5 of an library. <dependency> <groupId>groupIdName</groupId> <artifactId>...
0
votes
1answer
102 views

How could Azure's implementation of SAS be called Delegated Access Mechanism?

Shared Access Signature is a delegated access mechanism available for Azure resources and account. Based on the documentation here - https://azure.microsoft.com/en-in/documentation/articles/storage-...
4
votes
1answer
1k views

API Gateway security (for microservice architecture)

we have started with microservices recently, but we have some problems with implementing the Security layer. The idea is that the request comes to Gateway, the Gateway looks to authorization header, ...
0
votes
1answer
65 views

Windows Console App vs Service, Part II

Windows Console App vs Service I would like to extend the question at the above post, as the previous answers did a great job of helping me understand the difference between a service and not a ...
0
votes
1answer
45 views

Managing encryption keys in an application with add-on components

I am developing a product that uses custom hardware with accompanying software. It requires additional components which are sold separately to make the overall application work. Using these ...
2
votes
1answer
1k views

How to handle JWT expiry in Laravel 5.3?

I am developing a mobile application back-end service using Laravel 5.3. I am following REST API. Application having payment gateway integration and it needs more security. I followed JWT auth by ...
0
votes
1answer
59 views

security in selfhost web api

I am currently sketching out a project I am doing at my job, where I will have a self hosted WebAPI, connected to a serial device, where the app I am creating will configure that device. No, it is not ...
5
votes
1answer
209 views

Log off system on all devices

On websites like Facebook and Twitter, you've got a function to log off on all devices. How does it work? Does it work with IP addresses or something? What happens when you login on a device and use ...
0
votes
2answers
61 views

Allowing only users of the official client to upload media to my server. Possible?

I've been toying with a project idea for a while now but can't quite settle on one important detail. The plan is to write a client that can author and upload WebMs to a server for global viewing (...
-3
votes
1answer
84 views

Your opinions about an idea for better php applications security?

As we all know, security is very important when making any kind of application. That's why I came up with this idea, or rather I already made it happen. Thing is I am not sure whether it is really ...
1
vote
1answer
87 views

What would be a decent practice to get unique id for each MACHINE

I'm focusing my question on Windows OS, desktop applications. What would be a decent way to get a unique identification for every machine? obviously there many ways to do that, such as concatenating ...
2
votes
2answers
5k views

Difference between fabrication and modification

I came across one of the books related to information security where i saw these two terms, fabrication and modification of data. I can't figure out how they are different? What is the difference ...
0
votes
1answer
83 views

How to store keys for an encrypted storage in .NET in-house service

In the company I'm working for we have a certain service where users can upload documents (text, sometimes document scans), it's nothing confidential but if those documents will be leaked, I'll get a ...
5
votes
2answers
2k views

How do you log potentially sensitive data?

I'm working on a web application where the server side makes calls to a foreign server's web service API. The data passed to this API could contain sensitive data (like a user's password) as part of ...
14
votes
6answers
6k views

Is Reflection a disadvantage as private variables cannot be restricted?

The private modifier is used to restrict access outside the class, but using reflection other classes can access private method and fields. So I am wondering how we can restrict accessibility if it ...
0
votes
1answer
601 views

Is it necessary to use inline JavaScript with React? Would React therefore get blocked by default by Content Security Policies (CSPs)?

According to https://www.quora.com/What-are-the-key-difference-between-ReactNative-and-NativeScript/answer/Valentin-Stoychev , "ReactNative as using the notation found in React for inlining the UI ...
59
votes
14answers
13k views

Why did SQL injection prevention mechanism evolve into the direction of using parameterized queries?

The way I see it, SQL injection attacks can be prevented by: Carefully screening, filtering, encoding input (before insertion into SQL) Using prepared statements / parameterized queries I suppose ...
1
vote
1answer
304 views

How to structure JWT correctly

I'm designing a JWT authentication workflow for a RESTful API which uses two kinds of tokens: Phone token, a short-lived token - issued by completing an One-Time-Password challenge. Its task is to ...
0
votes
1answer
111 views

App1 through REST API create something that only admins in App2 can do

Let's say I have two web applications that are independent of each other. App1 is written in Python and App2 is written in Java. After some logic is done in App1 by normal user, App1 needs to create ...
1
vote
1answer
545 views

Securing a private API

I have two sites and an API that sends data back and forth between the two. The API is only used on the back end, and the user will not interact with it at all. What I would like to do is ensure that ...
1
vote
2answers
2k views

Refreshing a token best practice

I have been asked to implement refreshing a token. A token ID is the same as a session ID. I have considered resetting the session's idle time to 0 and continue using the same session ID for the ...
4
votes
3answers
90 views

Should authorized users be allowed to add autocomplete suggestions to the list of symptoms?

I am developing an online medical website (similar to a HIS) whose users are hospitals specifically hospital administrators, doctors, and other staff authorized by the hospital to use the system. ...
14
votes
5answers
6k views

Authorization and authentication system for microservices and consumers

We plan to refactor our company system into a micro-service based system. This micro-services will be used by our own internal company applications and by 3rd party partners if needed. One for booking,...
3
votes
2answers
2k views

Microservices and authorization

We are currently working on a micro-service based system. The idea behind it is to split our monolithic system to small domains (micro-service per domain). All services will be used by our internal ...
1
vote
6answers
4k views

How to verify that a file has not been tampered with?

Here's the scenario I'm trying to solve: In my application, users provide files to other users. I want to provide a way of verifying that files have not been tampered with. I wonder if this means ...
8
votes
3answers
3k views

REST API authorization strategies

There are a lot of questions on here that deal with the mechanics of authentication and authorization of RESTful APIs but none of them appear to go in to details of how to implement secure services at ...