Tagged Questions
4
votes
4answers
159 views
Security risk of adding a HTTP Header with server identifier
We are about to deploy a web application to a web farm of quite a few web servers. During our testing we have found issues happening in one of the servers but not in others. Most of them because of ...
3
votes
3answers
88 views
Why is it necessary to validate data in a servlet obtained by calling HttpSession.getAttribute()?
I am new to WebApp programming and am trying to understand the security implications of not validating data obtained by calling the javax.servlet.http.HttpSession.getAttribute() interface method. I ...
6
votes
7answers
533 views
Should I prevent sending of GET requests for urls that are normally operated with POST request?
There is an url that is normally operated using POST requests (i.e. POST request is sent when user submits form). But attacker can form GET request with parameters that are sent in POST request. This ...
6
votes
5answers
2k views
Can I block based on Mac Address?
Incase of dynamic IP's the hacker can work around by taking a new IP or use a Proxy, is it possible to make a ban based on Mac Address ?
I want to block at the Webserver level so that unwanted users ...
16
votes
8answers
829 views
Ways to secure yourself from Firesheep kiddies and other sniffing
Just a few days ago I had my first encounter with Firesheep. Luckily I was the one using it. Well, it scared me into looking for ways to secure myself. So I have two questions:
In exactly what ...
