Questions tagged [security]

For questions relating to cryptography and IT security. This can be computer, network, or database security.

Filter by
Sorted by
Tagged with
5
votes
1answer
156 views

How to configure HTTPS for deployments without a host name

I currently am in charge of networked linux based hardware that exposes HTTP connections. I want to be able to connect to these through HTTPS, but the hardware deployment has 1000's of installations. ...
5
votes
2answers
1k views

Should I be using a JavaScript SPA designed when security is important

I asked something kind of similar on stackoverflow with a particular piece of code however I want to try to ask this in a broader sense. So I have this web application that I have started to write in ...
5
votes
1answer
736 views

CSRF Protection with codeigniter

I have very little knowledge in application security. I have often seen to protect your application from csrf attacks developers use tokens and pass these tokens with request to validate. I want to ...
5
votes
2answers
473 views

Web application development security best practices [closed]

I am looking for the current, state of the art, coding standards for web development (mostly PHP). Since I do not want to reinvent the wheel I would like to reuse libraries written by people much ...
5
votes
2answers
2k views

Using Facebook to authenticate, how to link to user record in my app? Email?

I'm using Facebook to authenticate users. We also have conventional username/ password login and registration form too. Anyway, when a user chooses to login with Facebook, we use the following ...
5
votes
1answer
2k views

Means for (legit) cross-site scripting

Are there good means for allowing scripts from two or more domains to collaborate in the same browser page? I want to create an extensible platform, where I provide the model and some views, but also ...
5
votes
3answers
190 views

VPN or TLSv1 for securing a programs protocol from field device to mainframe

I am working on a product that requires devices to exists anywhere in the world hooked up to the internet though cell modems or on WLAN lines which communicates to a server(s) that exists elsewhere in ...
5
votes
1answer
77 views

OAuthv2 authorization grants

I just read this excellent tutorial on OAuthv2 but am still missing some important concepts regarding authorization grants. I'm fundamentally not understanding the necessity for the two request/...
5
votes
1answer
575 views

Safest way to use and store User's third party credentials

I'm working on an add-in that will integrate git into the VBA IDE. I'm using the LibGit2Sharp library under the hood, which supports User name and password credentials, but not SSH Keys. I would use ...
5
votes
4answers
5k views

What is the “correct” way to store functions in a database?

Note: Yes, I know that storing functions in databases should be punishable by law. We are developing a financial web application using PostgreSQL, Sinatra and AngularJS. As you may have guessed, a ...
5
votes
2answers
1k views

Is a PHP file secure enough on a GoDaddy Server to hard code an AES salt into the file?

So I am creating a web api for an app I am making. The data is sanitized before it is sent to my web api and then encrypted before it is stored in my MySql server. The phone app sanitizes then ...
5
votes
0answers
110 views

What To Do If I've Found a Vulnerability In a Possible Future Employers Site? [duplicate]

I've been self employed for a long time now and have recently decided that PHP development within a company is the route I'd like to go down. I had an initial interview/meeting yesterday with a ...
5
votes
1answer
665 views

Directly query database vs. Using web service

I'm a junior programmer, am working on a WPF application that will deploy to ~50 users. We basically are streamlining all of his charting/tracking of client data. Each user will probably make about ...
4
votes
2answers
1k views

One of my team members committed SQL injection-vulnerable code; should I report it to the manager? [closed]

One of my team members committed a huge mistake; a clear SQL injection-vulnerability. It obviously didn't pass my peer review and I made very clear that this is unacceptable. I never saw this ...
4
votes
4answers
347 views

Develop secureness first or as a later step?

The question Do you actively think about security when coding? asks about security mindset while programming. Obviously, a developer does need to think about security while coding — SQL ...
4
votes
4answers
4k views

Storing credit card information: Looking for a creative solution

I recently found the need to do recurrent billing. I am extremely averse to storing people's credit card information and I refuse to take risks in that area. I am stuck between a rock and a hard ...
4
votes
3answers
363 views

Is my app version a sensitive information

To make maintenance and versions tracking easier, I would like to expose the app version of each of the applications I develop on all my environnements. Can the app version and the last deploy ...
4
votes
3answers
454 views

How to implement better security in Linux?

I'm just investigating the security and control of the Linux platform in comparison to Android. In Android there seems to be a huge development around security - Applications are required to ask for ...
4
votes
2answers
253 views

Why should you prevent a search engine from indexing your development server?

I've heard that you shouldn't let search engines index your development server. The reasons given were: Duplicate content penalties Customers making purchases from an unsecured domain (if eCommerce) ...
4
votes
3answers
284 views

Preventing in database record tampering?

My question regards the best practice / industry standards to prevent rogue users/admins from directly logging into the database console and updating sensitive information such as financial info / ...
4
votes
3answers
312 views

Possible hack aftermath [closed]

After being hacked companies often give numbers and details on how much of their data was compromised e.g "13K user and passwords". After a possible intrusion how do you know what the hacker did in ...
4
votes
4answers
345 views

What security practices should you be aware of when writing software? [closed]

What different types of security do there exist? Why and when should they be implemented? Example: SQL Injection Prevention
4
votes
5answers
17k views

Building a web app with encrypted MySQL database entries?

I have some experience in building PHP based websites with MySQL access, storing encrypted user details, but all other fields being plain text. My most recent project will require sensitive data to be ...
4
votes
2answers
420 views

Is security a real argument for centralized version control?

I'm trying to understand if security is a real concern, or if distribution actually does a better job with security. See, the access to the main source repository could be layered and inherently ...
4
votes
2answers
315 views

Isn't it unsafe that any program can access cookies of a browser?

For example, for Firefox the cookies are kept as an SQLite DB in user's folder. Any program can read these cookies. So, for example, can't an .exe program read the contents of a cookie and pretend to ...
4
votes
2answers
266 views

Having an discussion about security concerns with another software engineer [closed]

Background: The company I work for uses different systems to hold their insurance data which is customer related. They want to have an app for their customers where they can find their insurance ...
4
votes
2answers
5k views

Should we store JWTs in database?

While creating/assigning the JWTs to users, should we also store them in our databases? The negatives/cons of storing tokens in database would be, that all the data in the payload of the JWT token is ...
4
votes
1answer
3k views

How to manage environment variables in local development

I'm in the process of writing a development philosophy document for a small groups of developers (6.5 developers to be specific), but it's ideally a document that will set down the company's best ...
4
votes
2answers
417 views

Polymorphism and the potential security issues

I just read an article on MSDN about reasons for declaring classes as sealed. In the last paragraph, Eric Lippert says: 4) Secure. the whole point of polymorphism is that you can pass around ...
4
votes
1answer
262 views

How do large corporations store API keys?

When FaceBook or Google give me an API key, are they just storing it in a database? Unlike a password, where you can hash and salt it before putting it in the database, it seems to me that a key ...
4
votes
2answers
1k views

Making sure database connection information is secured

This is the first time that I am working on a web application. I was going through the question What technical details should a programmer of a web application consider before making the site public? ...
4
votes
2answers
1k views

Is exposing a public API that calls a private API a good practice?

This is more about architecture question. I will be developing microservice in Lumen or Slim, it will not be accessible from the public. The private microservice will be dealing private stuff. ...
4
votes
2answers
338 views

Are there any widely accepted sets of standards/practices for secure coding? [closed]

The title should be fairly self-explanatory. We need to update our coding standards, and as part of this process we've been asked to try and follow an industry standard from a recognised/...
4
votes
3answers
3k views

Is it possible to check a client side application identity from server side? [duplicate]

Assume there is a web service which is visible publicly but it must be just responsive to a specific client application. Is there any mechanism to check client side application identity to prevent ...
4
votes
2answers
2k views

Secure an Application/Software by expiration with Date?

I have been working on some software application and I update them every 6 months. Currently, the way I track the date is by extracting the date from the system when the user installs the application, ...
4
votes
1answer
1k views

Using a public username as a login username

It has just dawned on me, that a system I am developing exposes a users username in the URI. This is a problem, since some of the users pages are public. Therefore people will know their username. I ...
4
votes
2answers
2k views

user security pattern recommendation/best practice

I'm looking for good reference on patterns that apply to user security and ACLs for multi-user network applications. I'm re-writing a fairly large application from scratch. Now I'm looking at the ...
4
votes
1answer
2k views

Is sending username via custom HTTP header good idea?

I have a route in a RESTful API where I need to pass a single username (email address) but not password. The route is designed to have GET method, so my options are either query parameters or a custom ...
4
votes
4answers
220 views

How to prevent data-scanning via public API?

Our customer (a bank) needs to publish a web-service API for use by 3rd party applications. The security is going to involve OAuth2 and JWT (JSON Web Token). The problem is that the customer is afraid ...
4
votes
1answer
1k views

API Gateway security (for microservice architecture)

we have started with microservices recently, but we have some problems with implementing the Security layer. The idea is that the request comes to Gateway, the Gateway looks to authorization header, ...
4
votes
3answers
90 views

Should authorized users be allowed to add autocomplete suggestions to the list of symptoms?

I am developing an online medical website (similar to a HIS) whose users are hospitals specifically hospital administrators, doctors, and other staff authorized by the hospital to use the system. ...
4
votes
2answers
4k views

Is setting “permanent” persistent login cookies a bad practice?

I realized that in Rails there is a built in permanent method for its persistent login cookies (aka. "remember me" cookies) method to give the client a cookie that expires in 20 years: cookies....
4
votes
1answer
403 views

Is it wise to include something like OpenSSL or GnuTLS with a project in a repository?

I am currently working on a project that makes use of the OpenSSL library for secure communications. Since this library is a requirement for building the project, I am considering including it in the ...
4
votes
4answers
246 views

System that splits passwords across two servers

I stumbled upon this news article on BBC, RSA splits passwords in two to foil hackers' attacks tl;dr - a (randomized) password is split in half and is stored across two separate servers, to foil ...
4
votes
3answers
1k views

Best practice regarding security in mobile applications [closed]

A friend asked me recently about mobile applications and the security surrounding them. As he wishes to make a mobile app that would handle very secure information such as credit card numbers, I was ...
4
votes
2answers
101 views

Is there a secure way to add a database troubleshooting page to an application?

My team makes a product (business management software) that our customers install on their own servers. The product uses a SQL database for data storage and app configuration. There have been quite a ...
4
votes
3answers
4k views

How to store uploaded client documents securely in webapplication

A small company without any IT skills wants to run a web application where customers can enter various bits of data and upload pdfs. The documents regard product specifications and have to be kept ...
4
votes
2answers
3k views

Best practice in application design / SQL authentication

I am currently involved in the implementation/design of an existing application for a large scale customer. The application has a similar model as e.g. vCenter Server whereby a number of components ...
4
votes
2answers
1k views

Is a traditional client app which connects directly to a database a good idea?

After using Django's excellent admin interface, I was pondering creating a similar system which wasn't as tied to an ORM. Now, while considering this, I thought that overcoming webapps limitations (...
4
votes
1answer
140 views

Architecture to lock account to mobile device

I'm currently creating a mobile app and have the following issue. I am required to only allow the user to login from a device that is registered to the users account. A user can have up to X number of ...