Should WAF or any protecting method, block SQLi done on URLs?(eg GET /test/url'or 1=1--)
My client has a small "Contact Us" form on every page of their website. They are adamant about not including CAPTCHA verification on these forms, to keep them easy to use, but I feel it is my ...
Mozilla Firefox 4.0 supports something called Content Security Policy that disables the interpretation of embedded Java Script. Only external Java Script files that are referenced using a script tag ...
Unfortunately, a client of mine still has an application based on ASP.NET 1.1. Yes yes, I know - horribly insecure, support ending, and on and on... I've already been through that with them. ...
I'm trying to change text links to real anchors. So for example I want to change http://example.com to <a href="http://example.com">http://example.com</a>. Since this is a user given ...
Should CSRF 'Double Submit Cookie' technique have a different seed value for the cookie versus the HTTP POST?
I'm reading about the OWASP double submit cookies method of protection and there it states that the cookie value between the header and form should match. That seems to be somewhat of a risk, as the ...
SQL Injection is always a hot topic particularly when it comes to web security. In this regard I am interested in what are the steps that should always be taken to prevent SQL Injection within any web ...
I know that to prevent (prevent all or most?) SQL injection attacks that you should use parametrized queries. I've been using hibernate for a while instead of hand writing my sql statements. Are there ...
How do you properly implement defenses against brute forcing? Is it best to store how many times someone tried to log in and block them after X attempts? And how would "someone" be identified? With ...