Questions tagged [client-side]
Client-side refers to operations that are performed by the client in a client–server relationship in a computer network.
270
questions
1
vote
1
answer
1k
views
Java Applet AccessControlException
I am doing a security course and a module on client side attacks, which is why this post might seem evil or outdated.
I have a Java applet fetching a malicious jar file and trying to then download ...
CommunityBot
- 1
19
votes
3
answers
16k
views
How do RSA SecureID ® Keys Work?
I have been using RSA SecureID ® Keys for quite some time now (perhaps 10 years), for things such as securely my home banking account online or accessing my company's network of computers from home. ...
- 2,599
1
vote
1
answer
345
views
Metasploit: java_signed_applet attack hangs after user response
I am trying to perform a client side attack with Metasploit on a 32 bit Windows 7 Professional N (SP1) victim. I have Windows Defender and Firewall disabled and Java Control Panel Security set at ...
CommunityBot
- 1
0
votes
1
answer
266
views
How to reliably identify referrer on client browser?
Is there any way to reliably identify the referring site on modern browsers (not considering manual HTTP requests outside of a browser e.g. cURL, etc.)?
Referrer header will not work because the ...
CommunityBot
- 1
1
vote
1
answer
195
views
How to prevent shopping cart alterations in another tab when paymentintent is already created?
Has anyone figured out a solution to this? I seem to have gotten to the same conclusion with no solution.
If I were to go the my app's checkout page, the payintent is created in the backend (explained ...
CommunityBot
- 1
9
votes
3
answers
17k
views
Certificate Chain checking
I have a very specific question.
A client verifies a server by taking the certificate and checking specific values and that the digital signature of the intermediate CA is correct (according to the ...
- 8,077
2
votes
1
answer
376
views
Public client or Confidential client: should I generate a client secret?
I've read about this but I don't fully understand how to choose.
I have two options:
Public client
"A native, browser or mobile-device app. Cognito API requests are made from user systems that ...
- 123
2
votes
0
answers
88
views
Security in Angular: Addressing XSS Concerns with External Libraries and Interpolation
Introduction:
We heavily use external libraries, such as DataTables, in combination with interpolation. In Angular, we've identified two primary XSS prevention strategies:
Interpolation ({{ }})
...
- 31
41
votes
6
answers
11k
views
How secure are my passwords in the hands of Firefox using a Master Password?
I'm relying on Firefox to remember my passwords, using a Master Password of more than 25 characters. How secure is this set-up?
- 183
1
vote
0
answers
93
views
Best practice of x.509 client certificates accross multiple systems
I have several MongoDB's where I use x.509 Certificates to Authenticate Clients
Let's say I create certificate and user for admin:
subject: CN=admin
issuer: CN=MongoDB Issuing CA
-> db.createUser({...
2
votes
3
answers
2k
views
How to securely store users API keys submitted through client
I am developing a web application which will require users to provide 3rd party API keys through the client, which will then be used to make requests to the 3rd party API from the backend of my app.
...
CommunityBot
- 1
1
vote
2
answers
664
views
How does the MITM attack work when a client does not check the hostname vs the certificate? [duplicate]
One of the Paho MQTT client SSL options allows checking whether "a certificate matches the given host name.". If I enable this option then I cannot establish a TLS connection to MQTT using ...
- 13
0
votes
2
answers
107
views
Web request TLS
What version of TLS would be required for a router that separates client requests from a web server behind a router?
Let's say the supported TLS client is 1.2 and so is the web server, BUT the router ...
- 48.4k
0
votes
1
answer
172
views
Need help about how to generate the Key and Passphrase to encrypt/decrypt data (JavaScript)
I am developing a public website (with https) where each user is going to register and save confidential data, this data needs to be encrypted/decrypted only by the user. I need help to know how to ...
- 109
0
votes
0
answers
248
views
client side certificate installed on ios 16 are not being sent by browsers on that device when a server requests for a identity cert
I have a client side certificate from cloudflare (non-root) that i install on our devices in order to gain access to our sites that ask for a client side certificate from browsers. This works ...
9
votes
3
answers
2k
views
How to implement client side encryption for CalDav & CardDav content?
I'm looking for a client-side encryption implementation that would be able to secure CardDav & CalDav data so that they couldn't be compromised even by the hosting provider.
Server side: PHP or ...
3
votes
2
answers
416
views
Are there any reasons to forbid employees from using desktop email clients?
Corporate email services often use web-based solutions like gmail or office365.
Is there any valid security concern in allowing third party email clients if two factor authentication
is enabled on the ...
CommunityBot
- 1
1
vote
1
answer
105
views
Logging secrets in the user agent (browser)
There are sound reasons not to put any secrets, PII or other sensitive information into the logs on the server side (see OWASP ASVS V7).
But should the same rule apply on the client side? Is there a ...
- 65.6k
0
votes
1
answer
2k
views
Client CA certificate & RADIUS
when my client tries to authenticate with Radius servers it gives following error:
unable to get local issuer certificate
As per my understanding, this is a trust chain problem or, in other words, my ...
- 230
2
votes
2
answers
3k
views
Session ID in the very First Client Hello
Is it normal to have Session ID in the first Client Hello, and then the server picks it up and accepts the same Session ID and uses it in all further TLS traffic. That is the "Client or Browser" tells ...
- 131
12
votes
2
answers
4k
views
How to protect against clickjacking attack but allow legit iframes?
I'm aware of modern anti-clickjacking approaches, such as X-Frame-Options header or framekiller scripts. But all these tactics prevent content to be inside iframe. But what if there is a requirement ...
CommunityBot
- 1
0
votes
0
answers
43
views
On the gains and losses of an additional client side stretching of the user password [duplicate]
Picture a state of the art implementation of a website registration and login system.
I'm interested in analyzing what a defender gains and loses by feeding the user password to a key-stretching KDF ...
- 1,271
0
votes
1
answer
87
views
What are the methods to prevent and detect front-end behavior alterations in mobile apps?
I don't know the technical possibilities of this attack, but the scenario as I will explain below sounds probable. So here it is.
I have a mobile app that does computation on the users phone and send ...
- 54k
2
votes
1
answer
258
views
Is any client-sided password just security by obscurity?
Let's say I want to deploy a simple static website (with no backend server) with some protected pages only visible after entering a password.
I could write a hardcoded salted hashed password and ...
- 23.4k
6
votes
2
answers
14k
views
How to store user credentials in browser securely?
I need help to authenticate users with user credentials.
We are using Angular 5 as a front-end & need to store the user's email and password if the user checks on Remember Me. Then autofill user ...
- 11
0
votes
2
answers
158
views
When using a user password for client side encryption, do I have to store the salt for the user encryption key on the server?
The password of the user shall be used for client side encryption. A PBKDF and salt shall be used to derive a key from the user password.
Do I need to store this salt on the server and deliver it to ...
- 48.4k
0
votes
0
answers
282
views
How to turn a relative path script (js) import to an absolue one with a url for XSS ? (more details below)
I have a parameter whose value is injected in the HTML as the following
<script src="/dir1/dir2/dir3/dir4/INJECT_HERE"> </script>
I was able to traverse back to just / but when ...
- 129k
0
votes
2
answers
95
views
How to secure an enpoint to prevent programatic calls from the client?
We have a game that is built on the client side. People who get past a certain level are eligible to enter a raffle. This is done by sending a request to an endpoint from the client once they get past ...
- 16.1k
0
votes
0
answers
107
views
Can you trust VPN clients on Windows?
I want to use a commercial VPN. It's more reliable when using their own client, since it can automatically select and switch servers etc. But what about the security?
On my Android phone, the apps are ...
- 371
1
vote
1
answer
881
views
How are session keys transferred between a client and a server?
Session keys are generated during TLS handshake and are transferred from clients to server through asymmetric encryption FOR ONCE.
However, I have heard that session keys are single-use, which mean a ...
- 1,992
0
votes
1
answer
340
views
How to send JWT Access token with requests without being sniffed?
I'm trying to create a mobile app which helps to connect with my mobile app. While going through authentication I used JWT. While authenticating it, it returns access token and refresh token to the ...
- 201k
0
votes
3
answers
518
views
Can I rely on the CSRF cookie to check if a user is authenticated on the client-side?
I have a website that runs on example.com. The website makes AJAX calls to my backend API which sits at api.example.com.
I employ a double-submit verification strategy.
The backend has protected ...
CommunityBot
- 1
0
votes
1
answer
316
views
Passing password back from server to client? [duplicate]
I've never seen any example of this and I'm just curious why? Why is it not okay just to pass it through HTTPs + encoded in a JWT? I will not be storing the password anywhere on the client side, I ...
- 266
-4
votes
1
answer
536
views
No SSL: Web Application Security using html fragment identifier (#)
I am currently running my website in shared hosting, and I am not able to register TLS/SSL for my website. However, I implemented jsencrypt [A Javascript library to perform OpenSSL RSA Encryption, ...
- 115
0
votes
0
answers
19
views
Is there hardware (like u2f-keys) for passwordless client-side encryption & decryption [duplicate]
I know that u2f keys are designed as authentication factors, but I think it would not be far fetched to also add a protocol that the user can use to encrypt or decrypt data on the client-side. This ...
- 727
10
votes
2
answers
4k
views
Asymmetric / end to end encryption for web messaging app
Background
I'm trying to design a secure and sustainable web app for messaging.
The purpose is to learn how to create secure web application.
The application is suppose to be written in Javascript ...
- 185
0
votes
1
answer
718
views
Upload Private Key into Web App
I am developing a web application that is integrating with a third-party that does not have OAuth capability, but instead use a variety of account IDs and keys to generate tokens for API calls.
On the ...
- 48.4k
0
votes
0
answers
218
views
A way to provide a TLS certificate that is not self-signed or using AWS private certificate authority
I need to secure the communications between my frontend and backend. My frontend resides in a PHP server owned by DonDominio (web hosting) and my backend in an instance in AWS.
My public web domain is ...
- 129k
0
votes
1
answer
120
views
Protect server-side key with client token
I'd like to encrypt some data on the server using a user-managed secret. I could just ask for a password and derive a key from that, but ideally I'd like to offer users the option of using a yubikey ...
- 201k
0
votes
1
answer
1k
views
Does copying cookies allow attackers to view pages that should be visible only after login?
TLDR;
Copying the request from ChromeDevTools along with all cookies allows me to view pages that I should not be able to view after logging in.
Have I been pwned ?
I just found a terrifyingly easy ...
- 9,434
38
votes
8
answers
16k
views
Client side password hashing
Edit: Updated to put more emphasis on the goal - peace of mind for the user, and not beefing up the security.
After reading through a few discussions here about client side hashing of passwords, I'm ...
- 1
3
votes
0
answers
540
views
OAuth for command line application
I'm planning to add an "official" command line tool for developers to interact with our API. The tool is basically just a glorified curl client, interacting with the API via HTTPS ...
CommunityBot
- 1
24
votes
6
answers
3k
views
Is it fundamentally possible to validate that an unmodified version of your client connects to your server?
Is it fundamentally possible to validate that an unmodified version of your client connects to your server?
I was just thinking about the idea of having my client-side app hash its own source code and ...
- 2,937
0
votes
1
answer
235
views
Can display a GIF in <img> tag causing Client-side DOS
SVG image can be used in DOS user browser with billion laugh attack. Can we do the same with other image types? especially GIF?
Thanks everyone.
- 48.4k
0
votes
1
answer
159
views
Why would you use random algorithm for CSFLE if you can't query the inserted data?
I think I really misunderstand something about data encryption. This guide (https://docs.mongodb.com/manual/core/security-client-side-encryption/#randomized-encryption) says the following:
"...
- 2,667
7
votes
3
answers
482
views
Logging error details in a (desktop) client application
I have a debate about how to properly log errors for the client part (Java Swing) of a client-server application from a security point of view.
I think it is common sense that exposing error details ...
- 5,408
1
vote
1
answer
165
views
Is android pentesting partially similar to web pentesting? [closed]
I'm already into web pentesting. I'm willing to learn android pentesting now.
From what I understand, the server side part like API etc is similar to web pentesting and I need to learn about client ...
- 62.3k
0
votes
2
answers
294
views
jwt symmetric signature security risks (from client side)
I am currently implementing an iOS app, which integrates with a cloud hosted .net backend system in azure, which.
The api login endpoint takes user/pass -> replies with an signed only HS256 jwt token....
- 48.4k
2
votes
1
answer
307
views
I discovered a Client Side Template Injection (CSTI), and after?
As part of a bounty bug, I discovered a Client Side Template Injection (CSTI). I would like to create more "impressive" payload to increase the risk of the vulnerability. The framework ...
- 274
1
vote
1
answer
305
views
Does streaming a game from a dedicated gaming VM still expose my PCs to significant privacy/security concerns from installed games?
So the plan is to make a Windows 10 guest, give it lots of vCPUs and memory, perform GPU passthrough to achieve maximal performance, and then load my games onto this guest. The aim of this would be to ...
- 1,522