Questions tagged [security]

For questions relating to cryptography and IT security. This can be computer, network, or database security.

Filter by
Sorted by
Tagged with
0
votes
1answer
110 views

How does signing headers and/or body provide security

I'm securing a WCF webservice with TransportWithMessageCredential security that uses certificates. So I'll have to choosee between signing headers & body or signing and encrypting. Now my ...
0
votes
1answer
3k views

Security comparison between xmlHttpRequest and HttpRequest

Is there a difference between HttpRequest and xmlHttpRequest in terms of security? Is one more secure than the other? Is it more secure to send important data such as passwords via HttpRequest than ...
0
votes
4answers
5k views

Application connecting to database server

I'm working on an application which requires user credentials and so on. So a database is required on the backend. What is the best practice to connect to a database without hardcoding your password ...
0
votes
1answer
2k views

How to do a login page for third party service without letting them sign on?

We have a unique situation (at least for me, first time seeing this). We have a web form where accountants can fill in requests and that part is taken care of. But after their login we redirect them ...
0
votes
1answer
46 views

rest service with digitally signed parameters

I'd like to build a rest service that will accept objects that has digital signature. This service has to support both xml and json data serialization formats. I'd like to use .Net core framework to ...
0
votes
1answer
52 views

Designing anonymous registration website

I am developing a website where customers can register products they bought in order to receive a benefit in the form of e.g. a cashback, a discount or promotional goods. In the future, we also plan ...
0
votes
4answers
56 views

Extent of Administrator Capabilities: HR and Design Logistics?

So I am developing an employee management application on behalf of a company and am concerned about the extent of rights and capabilities that are to be bestowed upon registered administrator accounts....
0
votes
1answer
114 views

Security and performance considerations when creating chat system on a Flask backend

I am building a website with the Flask framework. One functionality of the site will be that users can send messages to each other. I created a prototype of this using Flask WTF forms. The basic ...
0
votes
2answers
101 views

Mitigate a hacking attempt when it is detected by an app sitting behind a WAF

Let's say I have a web application where my users can log in, and save resources through my API and an ajax call. Now let's say I put my web application behind a Web Application Firewall (like ...
0
votes
1answer
69 views

Password manager inside application

Firstly this is not about how to store password for access to the application itself. That is handled using .Net Identity. Authentication is handled using JWT. So it is a web application. The problem ...
0
votes
1answer
199 views

Is it a good idea to load all user data on top of each file including sensitive information?

I've written a User class like this: <?php class User{ private $id; private $username; private $password; private $name; private $email; private $key; private $phone; ...
0
votes
2answers
93 views

How generate an anonymous (even for system administrator) identification number from a non anonymous identification number

Premise: I'm asked to develop a system that will trace sensitive data. The data are gathered by an intermediate operator (let's call him IO) on an office terminal. The final user (EU) will show up to ...
0
votes
1answer
56 views

Checking permissions with multiple database calls or in stored procedure?

I'm developing an APP that has a API and a database that holds user permissions and user projects, among other things. Certain stored procedures must be protected, and for that I have to check the ...
0
votes
1answer
198 views

Best practice to send data to webhooks without multiple redirects

I’m building a payment system for some ebooks with Reactjs on the frontend, Firebase as hosting and database and cloud functions at the backend side. Customers don’t need an account to buy ebooks so ...
0
votes
1answer
72 views

Risk Analysis in Open Source Community Driven Projects

I'm looking for perspectives on how risk analysis is performed when there's not precisely a "dollar value" associated with the risk, as in an Open Source project. Traditionally, risk analysis takes ...
0
votes
1answer
81 views

Security concept for a wiki-like application

I created a wiki-like application. Currently, there is no security, so all the contents have "edit"-buttons where the user can edit everything. Now, I want my application to have a public read-only ...
0
votes
1answer
119 views

What are the options to guarantee that a client that's connecting to a server is really who I think it is?

I have a proxy server that talks to a bunch of services and I want to have a way to prove to servers behind the proxy they are actually receiving a request from the proxy server and not from something ...
0
votes
2answers
128 views

Deployed Website's Integrity

Yesterday, the deployment of a financial website on a client was replaced with an older version which created unexpected issues and a downtime of almost 12 hours. We came to know that two guys from ...
0
votes
2answers
202 views

Multilayer security concept

I'm working on a security concept of a bigger project. It will be done with Spring,but that's actually not relevant right now. The whole system is a hierarchical tree of computer nodes that run a ...
0
votes
1answer
145 views

Using browsers to monitor changes in e-commerce pages

I've been looking at ways to monitor for changes in things like price and availability on e-commerce sites via visiting browsers, with three constraints: the sites often don't have much ongoing ...
0
votes
1answer
103 views

How could Azure's implementation of SAS be called Delegated Access Mechanism?

Shared Access Signature is a delegated access mechanism available for Azure resources and account. Based on the documentation here - https://azure.microsoft.com/en-in/documentation/articles/storage-...
0
votes
1answer
65 views

Windows Console App vs Service, Part II

Windows Console App vs Service I would like to extend the question at the above post, as the previous answers did a great job of helping me understand the difference between a service and not a ...
0
votes
1answer
60 views

security in selfhost web api

I am currently sketching out a project I am doing at my job, where I will have a self hosted WebAPI, connected to a serial device, where the app I am creating will configure that device. No, it is not ...
0
votes
1answer
84 views

How to store keys for an encrypted storage in .NET in-house service

In the company I'm working for we have a certain service where users can upload documents (text, sometimes document scans), it's nothing confidential but if those documents will be leaked, I'll get a ...
0
votes
1answer
112 views

App1 through REST API create something that only admins in App2 can do

Let's say I have two web applications that are independent of each other. App1 is written in Python and App2 is written in Java. After some logic is done in App1 by normal user, App1 needs to create ...
0
votes
1answer
60 views

Hash system to generate same (specified) hash from multiple datasets?

I have a hashed value X and need to ensure that any of the data sets D1...Dn can be concatenated with a correctional value C1...Cn and passed into a hashing algorithm to result in the value of X. ...
0
votes
1answer
87 views

Universal Form Handler

I'm building a API that gets called from web / mobile applications written using Ionic (web languages on mobile), which uses Angular.js. We want to be able to do server side validation of forms but ...
0
votes
1answer
109 views

Question on password hashing security

I'm about to add some user account and password functionality to my software, so I'm reading about password hashing. So my understanding is Hashing is a one way function, and it works like this: ...
0
votes
1answer
301 views

File sharing web application - folder PIN code entry best practice

I'm developing a web app for internal file sharing and one of the requirements is to have PIN code protected folders. What I came up now is a folder like structure with the following: Folder ...
0
votes
1answer
223 views

Algorithm to maintain a blog sign up page

I have a functional sign up page for a blog that updates a database with a users name, email, profile picture and a short bio. The General information page and the profile picture upload/bio page are ...
0
votes
1answer
91 views

Logging private data

In general, I write a debug log whenever one of my functions is entered, including the parameters. For instance: function execute_query($query, $conn_string) { $this->log->...
0
votes
2answers
136 views

How to protect controller endpoint from abuse?

I am building a web app that will first validate a promotion code via AJAX call and then if it is valid, allow the user to fill out the rest of the form, I use KnockoutJS to reveal and hide the ...
0
votes
1answer
80 views

How Do I Securely Edit a Database Entry Based On ID in an Admin System?

This is more of a conceptual question because the way that I am doing it would be secure enough for my purposes (educational). I created a simple admin panel that displays a stock picks database as ...
0
votes
2answers
151 views

Security scheme that prevents duplicate message attacks

I am using custom security scheme to verify communication between client and server. Both client and server have same secret hash phrase. Client builds a message, combines it with hash phrase and ...
0
votes
1answer
164 views

Developer account in OSX, admin or managed user with our without sudo access?

The tutorials I find to setup OS-X for web developer programming (installing x-code ruby js cocoapods sql c asm etc) leave out if it should be done from an admin account, or standard (managed) user. ...
0
votes
1answer
45 views

How to create work for a client on login

I have a log-in service that runs a CPU-intensive hash multiple times when a user logs in. In order to reduce the effect of a login DDOS, is there any sort of function that I can "ask" that the client ...
0
votes
1answer
107 views

Roles configuration strategy

We're close to start new project using sf2, and, probably, FosUserBundle. Keeping that in mind - what's the best strategy to define roles? App will be used by multiple divisions inside our company (...
0
votes
1answer
86 views

Securing web services [duplicate]

How to approach securing webservices? I can think of using one of the two approaches below sending a user name password in every request for validation Sending a time based token (GUID or some ...
0
votes
1answer
105 views

Is there a design pattern for updating lists?

I want to modify one list (actually info stored in a database). A person doesn't have access to update every part of the list, but can update and delete parts they do have access to and add whatever ...
0
votes
2answers
350 views

Snapchat clone: How do I secure pre-downloaded notifications so that they cannot be opened outside of the app?

Say I'm making a snapchat clone app for Android and iOS. Let's say that I get a snapchat from Baz. I want to pre-download the audio for this snapchat. However, as the developer, I want to secure this ...
0
votes
1answer
162 views

Do we have any special design considerations for maintaining anonymity in an application?

This is an open-ended question which I am analysing while doing some fun projects in leisure. Websites like Google, Facebook do store user activities and perhaps sell them or use them for ...
0
votes
1answer
114 views

Possible holes in a spam-registration prevention approach?

I was thinking of creating some login code (probably to work with BrowserID so users don't need to store their passwords with my site while also ensuring the supplied email account belongs to them) ...
0
votes
1answer
665 views

Asp.Net MVC Windows authentication - vulnerabilities of http vs https?

I am developing an ASP.Net MVC 3 intranet site that will use Integrated Windows Authentication exclusively. What are the vulnerabilities of the challenge/response authentication traffic being sent in ...
0
votes
2answers
957 views

How does Facebook strip html/apostrophes for XSS but also display it?

I'm not quite sure if this is a question for programmers.se rather than stackoverflow, but here goes. So Facebook [or any other large company] when given something like an apostrophe or html, can ...
0
votes
1answer
822 views

MVP Pattern - Ways to restrict the user action based on security privilleges

In an MVP application, what should be the most appropriate way to implement restriction to some UI actions based on the current user's privileges? For example, in a role-based security, different ...
0
votes
1answer
260 views

Ria service security

I have a silverlight app that connects to a entity framework over WCF ria service. These calls have to be secure. What can I do so only valid users can call the ria service, and to make the call ...
0
votes
1answer
3k views

Should OAuth token be shared to implement SSO?

What's a commonly accepted way of implementing SSO using a third party OAuth provider? I have a server with user resources associated with server's user ID, the user ID also has a Facebook user ID ...
0
votes
1answer
214 views

Security aspects of an ASP.NET that can be pointed out to the client

I need to write several passages of text in an offer to the client about the security layer in ASP.NET MVC web solution. I am aware of security that comes along with MVC 3 and an improvements in MVC ...
0
votes
2answers
258 views

Assigning a local id to a user

I am creating a soap service where users will be able to interact with each other. They will have a contact list where people can be added. One of the security measures(others are in place, too) is to ...
0
votes
1answer
831 views

Legal Requirements for Software Makers

Since the Legal site of Stack Exchange isn't ready quite yet, I figured this would be the best place to ask this question. What are, if any, the legal requirements (or online resources for finding ...