New answers tagged security
1
In this instance an SSH connection is not necessary. If someone unsavory can listen to network traffic between processes on a single machine, you've got more serious problems to deal with.
With that said, it might be a good idea to use SSH anyway as a matter of maintaining a habit of always encrypting connections, regardless where they're made.
0
A principle of security is that you have to consider everything that is ever sent to the client or installed on the client as available to the user.
You can and should use httponly and samesite to prevent the token to leak to other sites or applications. But you can't keep the user from using the token. They can hit F12, or use Fiddler to decryopt their own ...
0
Licensing is difficult, which is one of the reasons there are third party products to enforce licensing for you. And in the context of this question we are simply talking about license enforcement. You do have to define what you mean by "airtight", and whether you support licensing enforcement on private networks.
By running a Python based application, ...
3
Suppose the following scenario
A user logs in into your application from 3 different devices.
Each device gets a separate JWT to remember the login, with a different expiration date & time.
That user changes their username and/or email address from device 1.
The question is, is it acceptable that the action in step 3 automatically logs the user out on ...
Top 50 recent answers are included
