Questions tagged [security]

For questions relating to cryptography and IT security. This can be computer, network, or database security.

Filter by
Sorted by
Tagged with
1
vote
2answers
161 views

securely store credentials for an unsecure API

I'm writing a slack bot that interfaces end users with an API. That API only method of identification is the raw "login:password" encoded to base64 (it doesn't answer back a token) ... Currently in ...
1
vote
1answer
249 views

Secure delete a registry key

On a regular Hard Drive a secure delete of a file is possible by overwriting it, does simply overwriting the registry key is enough to secure delete the key ? If not how I can proceed to secure ...
1
vote
1answer
850 views

Securing a private API

I have two sites and an API that sends data back and forth between the two. The API is only used on the back end, and the user will not interact with it at all. What I would like to do is ensure that ...
1
vote
2answers
2k views

Refreshing a token best practice

I have been asked to implement refreshing a token. A token ID is the same as a session ID. I have considered resetting the session's idle time to 0 and continue using the same session ID for the ...
1
vote
2answers
158 views

Architecture supporting digitally signing of tons of soap requests [closed]

What is the optimal architecture for such case: Web application(.Net Web Forms) connects to third party web service via wcf. Third party web service accepts only digitally signed soap requests Some ...
1
vote
1answer
268 views

Is opening a templating engine to users a bad idea?

My site allows users to create custom HTML templates for their profiles (very much like Tumblr and the theme system), and I picked the Twig template engine for the site. However, I'm not sure if it'...
1
vote
1answer
85 views

API authentication with a single ID

A typical API authentication usually rely on a pair of API ID + SECRET, my question is: if the API ID is unique and randomly generated and is considered strong enough (e.g. SHA512), why a SECRET is ...
1
vote
1answer
82 views

What's the proper name for the type of security where we secure resources by ownerrship?

I work on a REST API that mixes two types of security: First you have standard role-based security - so we have multiple roles such as administrator, read-only user, super user user, etc. Then we ...
1
vote
2answers
136 views

Is it a good idea to require passwords in offline applications?

I am developing an application which can install extension modules (plugins, if you will) from APT-style repositories hosted elsewhere. The plugins need not be signed (although the downloads are ...
1
vote
1answer
845 views

Is this type of data insertion safe and can stop sql injection in Python?

I am learning Database connection from MySQL Connector/Python Developer Guide. This is the code I am using to insert data: conn = mysql.connector.connect(user="user", password="password", host="127....
1
vote
1answer
2k views

What is the proper way to extract and pass parameters to call javascript functionality from my PHP page?

This is my situation: I have a search results page in PHP where most of the logic resides in a javascript file in order to avoid refreshing the page every time an action is performed. The first thing ...
1
vote
1answer
119 views

Creating an account to receive sensitive information on a mobile device

I am developing an Android application for my final year project which allows the holder of a mobile device to receive a text notification containing potentially sensitive information from a server. ...
1
vote
1answer
7k views

Is the escaping provided by the Google-Gson library enough to ensure a safe JSON payload?

I am currently using the Google-Gson library to convert Java objects into JSON inside a web service. Once the object has been converted to JSON, it is returned to the client to be converted into a ...
1
vote
3answers
188 views

How do I trust an off site application

I need to implement something similar to a license server. This will have to be installed off site at the customers' location and needs to communicate with other applications at the customers' site (...
1
vote
1answer
2k views

Performing user authentication in a CodeIgniter controller constructor?

In "The Clean Code Talks -- Unit Testing", Miško Hevery mentions that "as little work as possible should be done in constructors [to make classes more easily testable]'. It got me thinking about the ...
1
vote
1answer
657 views

Javascript: Safely upload a client data file

I'm (still) working on a template-based XML editing program. It's a GUI-based XML editor that only allows users to add certain tags and attributes based off the requirements. You can see the current ...
1
vote
3answers
646 views

API access question

FIRST, THE SCENARIO We have an internal system that is effectively split into 2 very separate parts across 2 sub-domains, our back-end administrative system for internal access only we will call this ...
1
vote
1answer
544 views

When should I invalidate a cache of a user's credentials?

We develop a Windows client application that locally caches a user's credentials for connecting to our server application using the Windows Credential Management API. Our caching logic works in the ...
1
vote
2answers
1k views

SQL injection attacks, how do I test and secure coldfusion queries?

I'm running Coldfusion 8 and SQL server 2008. I've been building serveral forms that insert data into the database from external users, we have a custom built security module built by the guy who I'...
1
vote
1answer
143 views

Strategy for securing paid Data as a Service API

When creating a webservice/api that is intended to be used by javascript/flash/mobile clients, what is a good method for making sure that a paying client's credentials are not stolen and reused. To ...
1
vote
1answer
66 views

How can I share authentication information between all the server?

I'm developing a web service that have following structure: Web Server: this is implemented with NextJS which do Server-Side Rendering and serve server-side rendered webpage data to Client. API ...
1
vote
1answer
21 views

Identity Server 4 Authentication - Security questions around using the same API for internal application and third parties

So, I have an API that authenticates with Identity Server OAuth2 and gives our user a JWT token when logging in through a front end application, this is a token that has access to everything. The API ...
1
vote
1answer
285 views

License control for an on-premise application

TL;DR How do you build an airtight license control system for your onprem application, which revokes access once subscription ends? Premise I am building this application in Python that needs to ...
1
vote
1answer
470 views

How to store private ssh keys for my application?

I 've a pair of private and public ssh keys, which I'm using in encrypting and decrypting my JWT. So I'm creating and signing my JWT with my private key and shared the public key with the client who ...
1
vote
1answer
84 views

Is it more secure to use more PKI keys?

Consider a token issuer/validator. Every token is PKI signed. Is it more secure to use a new key-pair (performance could be ignored for now) per request or is it no difference to have only one key-...
1
vote
1answer
62 views

Allowing a dynamic list of IP addresses to access a specific port in an AWS EC2 Instance

The problem I am trying to solve today is DDoS. I am working on a game project which is hosted on a TCP port (7777). The game is known to have a community full of idiots (pardon the language) that do ...
1
vote
1answer
184 views

Single Sign On Logout Strategy

I have been working on a project that integrates spring-cloud-based microservices and MVC applications with SSO. currently, I use spring-session for the session repository service. My current ...
1
vote
1answer
62 views

Should I separate the REST sessions from the sessions in the rest of the application?

Assuming I have resources I restrict access to with a username + password login in my web application and in my REST API. Should I keep different sessions for both meaning that a login via the web UI ...
1
vote
1answer
80 views

How to make a secure web-app account system?

i have some experience (mostly as a student) with react and redux, and on the other hand i also have some experience with express, normally for my apps (all of them are really simple) i make a rest ...
1
vote
1answer
715 views

What are security risks of WYSIWYG HTML/CSS/JS editors running as web service?

I am currently implementing WYSIWYG editor that will be available on the web, what are the main security issues I should tackle? The editor currently works that when user is done typing, the text gets ...
1
vote
1answer
122 views

What would be a decent practice to get unique id for each MACHINE

I'm focusing my question on Windows OS, desktop applications. What would be a decent way to get a unique identification for every machine? obviously there many ways to do that, such as concatenating ...
1
vote
1answer
91 views

When do I reset Two Factor Authentication secret keys?

I have built a simple authentication system for my web application that makes use of the open-source time-based OTP algorithm (RFC 6238). The key for each user is generated when the user is registered ...
1
vote
1answer
143 views

Porting security from Java/.NET to PHP

This probably a rather naive question given my limited knowledge in the code I've been looking at, but I want to get my head around it before I start diving into writing actual code myself. I'm ...
1
vote
2answers
2k views

Avoid data manipulation by user

I have a C# program (could be any programming language) that saves data to a file on a memory (hard disk, USB drive, etc.). The program uses this data for monitoring its operation time, but it could ...
1
vote
1answer
233 views

What is a simple, correct and secure way of executing code stored in database?, that is also sandboxed

Webhooks can be a very powerful thing when you try to automate or integrate software, however, handling their deployment in a controlled environment can suck in terms of security and deployment alone. ...
1
vote
1answer
113 views

How to store sensitive information (e.g. clients' credentials) accessibly for everybody inside?

I just discovered that we store sensitive information on our SharePoint. Since it's accessible by a password alone (and we all know that others click for the password/user name to be automatically pre-...
1
vote
2answers
296 views

Secure Rest api from authenticated user

Let's say that my Rest api is secured using OAuth 2. Let's say my client is a mobile App. Let's say that i have an Api call: @Post /increasePoints host:https://www.example.com/increasePoints amout=...
1
vote
1answer
905 views

Browser game played in an iframe - security concerns

I'm not sure if this counts as an Information Security or Webmasters question rather than Programmers, however I'll see how we go. I've been prototyping a help website for a particular browser game, ...
1
vote
1answer
123 views

Testing for Authentication loop holes / bugs

We've got a web application which is 99% complete prior to public beta, were currenlty securing the site from security perspective, locking down the server, db etc, one thing I'm concerned about but ...
1
vote
1answer
539 views

What Kind of Source Control Do High Security Projects Use? [duplicate]

I was just reading this slightly older post on choosing a good source control system when I started thinking about how different projects use source control. Where I work we've essentially moved ...
1
vote
2answers
692 views

Hide admin menu if no admin option is available

If you have a menu "Admin tasks" and different admin tasks (like 10) that you could separately assign to each user, but there are users who don't have any admin tasks, how would you deal with "Hiding ...
1
vote
1answer
2k views

Implicit OAuth2 endpoint vs. cookies

I currently have an app which basically runs two halves of an API - a restful API for the web app, and a synchronisation API for the native clients (all over SSL). The web app is completely ...
1
vote
1answer
1k views

Is it safe to generate client nonces using random number generator?

I am making HTTP calls on the client side and the server expects me to supply a client nonce. It needs to be 4 bytes long. I am planning to use this combination: base64(parts of the MAC address + ...
1
vote
1answer
90 views

Is this mini-DSL for hiding URI passwords compatible with the URI spec?

Passwords exposed in URIs An application stores URIs to be used for file transfers via SFTP, FTP, FTPS and SCP. Many of these URIs contain passwords, for example: sftp://someuser:sekrit@host....
1
vote
1answer
295 views

Creating deterministic key pairs in javascript for use in encrypting/decrypting/signing messages

So I have been searching everywhere and havn't been able to find anything with the sufficient information I need.. so Im a bit stumped on this one at the moment What I am trying to do is create a ...
1
vote
1answer
222 views

How to securely store user credentials from external website

I'm developing an application where I'd like to use credentials from external websites. This will be used to login with the website API and get information for the user. Example: I want to use the ...
1
vote
1answer
405 views

Books or guides regarding secure key storage and database encryption [closed]

I have an idea for a SaaS product I want to create, however, this product will store extremely sensitive data that needs to be encrypted at rest. The trouble is not so much the encryption, but the ...
1
vote
0answers
30 views

Securing Arbitrary Code

I need to run arbitrary code snippets in Python and Javascript on a server. It cannot be run in the browser. I'm thinking of sandboxing the code in an AWS Lambda serveless function. However, I'm ...
1
vote
1answer
50 views

Designing Kafka topics for secured event driven job scheduling system

Consider the following Group A Job A { Depends on Job B of Group A Run User -> User1 } Job B { Depends on Job C and Job D of Group A Run User -> User2 } Job C { Depends ...
1
vote
0answers
17 views

Defining custom OIDC provider with delegating authentication to another OIDC provider and using own authorization database

I wanted to ask about your ideas on how to solve the problem that I have to solve in my application (App1). This is the classic Fronted + Backend (Angular + Java EE) application to which I am ...

1
10 11
12
13 14
17