Definition: HTTP - the Hypertext Transfer Protocol - provides a standard for Web browsers and servers to communicate. The definition of HTTP is a technical specification of a network protocol that software must implement. HTTP is an application layer network protocol built on top of TCP. HTTP ...

learn more… | top users | synonyms

1
vote
1answer
2k views

Is it possible to secure a web app without HTTPS? [duplicate]

Possible Duplicate: Can you secure a web app from FireSheep without using SSL? Think of a typical web application where the users log in, and then the session is kept with a session key. Is ...
43
votes
8answers
4k views

Why is HTTPS not the default protocol?

Why is HTTP still commonly used, instead what I would believe much more secure HTTPS?
0
votes
2answers
1k views

Strange 400 requests in webserver nginx logs (possible exploit scan?)

It's one of the logged by nginx webserver requests: ‹\x11Г»=џ&gьµЈБЈx¬ёђАЙхPЙuN0жЫ¶@Oc[ќЮmћC”Ь™\x04»c/‹\x1F or ...
3
votes
3answers
308 views

How do you make sure a pdf is deleted after being viewed in the browser?

For things like images or html documents, cache headers make sure that the data is deleted when the browser is closed. However as PDFs are opened in a plugin, the cache headers do not seem to have the ...
35
votes
9answers
28k views

Can my company see what HTTPS sites I went to?

At work my company uses internet monitoring software (websense). I know if I visit a https ssl-encrypted site (such as https://secure.logmein.com) they can't see what I'm doing on the site since all ...
11
votes
8answers
2k views

What chars should I not allow in passwords?

I am planning to develop a website that require that the users register a username and a password. When I let the user choose a password, what chars should I allow the users to have in the password? ...
6
votes
2answers
821 views

GET with additional parameters leads to “code injection” in html displayed

We got a security review done of our PHP code and the security company sent this in their report: Request GET ...
10
votes
6answers
3k views

Security review: “HTTP header user-agent has been set to (something)”

We got a security review done of our PHP code and they team advised this in their report (amongst other things): /appdir/ Details The HTTP header user-agent has been set to \" . Request GET ...
9
votes
5answers
7k views

Can I block based on Mac Address?

Incase of dynamic IP's the hacker can work around by taking a new IP or use a Proxy, is it possible to make a ban based on Mac Address ? I want to block at the Webserver level so that unwanted users ...
114
votes
8answers
48k views

Is BASIC-Auth secure if done over HTTPS?

I'm making a REST-API and it's straight forward to do BASIC auth login. Then let HTTPS secure the connection so the password is protected when the api is used. Can this be considered secure?
9
votes
1answer
12k views

How does basic HTTP Auth work?

How does basic HTTP Auth work?
18
votes
8answers
1k views

Ways to secure yourself from Firesheep kiddies and other sniffing

Just a few days ago I had my first encounter with Firesheep. Luckily I was the one using it. Well, it scared me into looking for ways to secure myself. So I have two questions: In exactly what ...