Definition: HTTP - the Hypertext Transfer Protocol - provides a standard for Web browsers and servers to communicate. The definition of HTTP is a technical specification of a network protocol that software must implement. HTTP is an application layer network protocol built on top of TCP. HTTP ...

learn more… | top users | synonyms

2
votes
1answer
110 views

How to get a green certificate bar if I'm not a company?

I'm not a company and do not represent one, but I would like to have a green bar on my website for several reasons. One of them, for example, is that I want to ensure that the information displayed in ...
2
votes
1answer
72 views

Is using Gravatar in a web application with “private” URLs a security issue?

In our application, there is a kind of a "share" feature that sends an email to a user-provided address. This email contains a link with a secret access token (as part of the URL) that is valid for a ...
2
votes
2answers
711 views

How to implement password reset functionality without becoming susceptible to cross-domain referer leakage?

I have typically implemented password reset functionality by sending a link that included something like this: http://example.com/pwreset?id=userId&resetToken=superSecretResetToken On my pwreset ...
2
votes
1answer
256 views

Why is the HTTP Server header not used by most servers, but the User agent used by most browsers? [closed]

I've read that the Server header would disclose information, and that its use would be bad. The arguments made in that question also apply for the User agent header. So why is it still used, and not a ...
2
votes
4answers
413 views

Why aren't we all compromised on the internet?

Well, I've been thinking about this for a while now. Within the last decade, we've used various ways to make our websites look dynamic and live. For example, in JavaScript, it's quite easy to send ...
2
votes
2answers
201 views

How to create an anti-flood mechanism without leaving VPN's out?

I'm trying to protect my applications from some bots that are either malfunctioning or trying to take my sites down (lots of requests from the same IPs in the logs). Every time someone requests an ...
2
votes
3answers
4k views

Is it possible to list folder from my web server if i have an empty index.html in the root folder?

I have a small mongoose web server installed on my machine. I have a empty index.html in the root directory. I want to be able to share link with people i know, by creating a folder that look like ...
2
votes
2answers
1k views

What if a browser does not understand the secure flag of cookie

I have two questions related to the same: 1 - As 'Httponly' attribute is understood by a set of modern browsers (https://www.owasp.org/index.php/HttpOnly#Browsers_Supporting_HttpOnly), I was ...
2
votes
2answers
93 views

What information can my ISP see using squid proxy?

My ISP provides a transparent proxy to use and I can see that they are using the squid proxy for caching this. What I am wondering is what data can they see and what can they see further if they can ...
2
votes
2answers
112 views

Can two users share the same Request.UserHostAddress?

I am working on an ASP.NET MVC-5 web application, which is available to public users (no login is required). And I need to prevent the same user from submitting more than 5 "contact us" requests ...
2
votes
1answer
129 views

How does LastPass know that Microsoft.com uses the password for Live.com?

When I visit Microsoft.com, the LastPass dropdown lists my username/password for login.live.com. It does something similar for Playstation.com and several other sites. How does it know? Are these ...
2
votes
2answers
517 views

Best practice for caching sensitive data

My server returns private data in the body of an HTTPS response. It's not passwords or credit cards, but it is user-generated text and images, which should not be accessed by others. The data for a ...
2
votes
1answer
1k views

Mandatory to implement HTTPOnly if Java Secure Cookies are set to 'true'?

Here is a test case from a recent application security asessment which I have had experienced: cookie = new Cookie(strKey1, EncryptDecrypt.encrypt(strValue)); cookie.setMaxAge(-1); cookie.setDomain(...
2
votes
2answers
599 views

Is HTTPS as secure or more secure than SSH if both have an IP address whitelist?

I'm wondering whether an HTTPS API endpoint would be as secure as or more secure than SSH. API Endpoint The API endpoint would require HTTPS The API authentication would use a POST'd API key. The ...
2
votes
3answers
2k views

Why don't more websites implement Perfect Forward Secrecy?

From what I understand, all it takes to enable PFS on a webserver is adding ephemeral cipher suites (ones that use DHE and ECDHE for the key exchange) to the list of cipher suites used in SSL/TLS ...
2
votes
2answers
7k views

POST over HTTPS “secure enough” for sensitive data?

I'm wondering if to prevent the possibility of a compromised SSL certificate leading to the potential for sensitive information disclosure if it might be prudent to further encrypt data being passed ...
2
votes
1answer
449 views

HTTP Basic Auth is enough?

I have WebSVN, Gitlab and phpMyAdmin hosted on my dev server. Now, all of it, I password protect the pages (not their individual login) using HTTP Basic Auth, is this the best practice that I can do?
2
votes
2answers
2k views

Signed request vs HTTP digest auth for API authentication?

By signed request I mean something like this (simplified example): Client creates a sig in his request: $sig = hash('sha256', $api_key.$data); which generates 7409ur0k0asidjko2j for example. He then ...
2
votes
2answers
3k views

Secure SSL Session from losing itself into unsecure http

I've seen some implementations of HTTPS SSL and, as a visitor, forced to rely to a lot of those. What would a secure implementation look like and where can one expect problems? I expect the installer ...
2
votes
1answer
44 views

Unsecure to allow all headers? [closed]

I'm currently developing an webapp. For testing and developing I allowed all Headers. Is this unsecure for productive use? Header unset Connection Header unset Time-Zone Header unset Keep-Alive ...
2
votes
3answers
299 views

IP over HTTP GET only

Consider the following scenario: There is a client behind a really strict firewall. There is nearly nothing available to 'connect to the internet'. Just DNS resolution and HTTP/HTTPS (some whitelisted ...
2
votes
2answers
91 views

Disclosure and HTTP status codes

Disclaimer: yes, I have checked the Which HTTP status codes are interesting from a security point of view? which sounds relevant but not entirely. These days it's supposed to be a good practice to ...
2
votes
2answers
294 views

How can I be sure that I'm downloading over SSL?

Maybe I'm asking absolutely dumb question, but I couldn't find the answer yet. I know when I'm sending or getting a data in a browser over https, both server and client (browser) checks each other ...
2
votes
2answers
772 views

What was the security vulnerability behind Box and Dropbox and what's different now?

Earlier today I received a number of comments saying that my shared links were disabled. I looked around and saw a number of articles explaining what happened, and Dropbox posted an official statement ...
2
votes
1answer
2k views

Web service HMAC authentication/anti-replay

I am creating a web service, which handles various requests from web clients. The client and server share a big secret key S, and when one part wants to send data, it calculates the token as follows: ...
2
votes
2answers
3k views

Is it harmful to allow http requests with very long querystrings in IIS?

I am developing a website with a search feature that could generate HTTP requests that are very long (up to 15,000) characters. However, IIS has a default limit of 2048 characters for querystrings. ...
2
votes
1answer
147 views

Why do Browsers warn about self-signed certificates but not about plain HTTP (which is not even encrypted)? [duplicate]

Let's keep it short: On HTTP everyone can listen easily. MITM attacks are no problem. On HTTPS (self-signed) everything is at least encrypted, it's much harder to MITM-attack and only private key ...
2
votes
1answer
187 views

Capturing (1x Only) HTTP POST Request [tcpdump]

Every now and then; I like to fire up tcpdump and just watch the network traffic as the packets flow on by. For example: user@host:~$ sudo tcpdump -Aevvv Will parse & print all local ...
2
votes
1answer
142 views

Can cascaded routers protect inner network's machine from attacker from outer network?

Given: Outer Network router A wan ip 209.123.12.11 address 10.10.0.1 machine A address 10.10.0.10 gateway 10.10.0.1 Inner Network router B wan ip 10.10.0.100 address 192.168.10.1 ...
2
votes
1answer
262 views

Understanding a suspicious HTTP request

While debugging my server for issues, I checked my logs frequently. Here is one weird one I've found, which seems like an attempt to run something on my server. I am using nginx on Ubuntu 14.04. Below ...
2
votes
4answers
1k views

Does referrer header checking offer any real world security improvement?

At work we use a central portal that provides basic SSO functionality to other applications. In addition to verifying the SSO data sent, all of our existing in-house applications (used by the public) ...
2
votes
2answers
307 views

How to prevent attacks before HSTS is established for the first time? [closed]

What is the best way to accomplish this and prevent attacks like SSL Strip?
2
votes
1answer
514 views

In Same Origin Policy, why are different protocols considered a security violation?

I can understand why content from different domains is considered to be unstrusted for the same origin policy. But, how can be content from diferent protocols from the same site/domain be dangerous? ...
2
votes
2answers
1k views

Token based authentication under http

I am doing a token based authentication but facing some security problems. In the system, a user will login as follows: Type username and password to login in a https login page If the login is ...
2
votes
1answer
4k views

In which ways could a javascript making a cross domain HEAD request be a threat?

I was just reading this answer to the question Why is the same origin policy so important? Basically, when you try to make an XMLHttpRequest to a different domain, the browser will do one of two ...
2
votes
2answers
706 views

HTTPOnly Cookies: Security Depends on Client Cooperation?

I've been implementing HTTPOnly cookie-based session handling and have some questions about what HTTPOnly means. I realise it's a flag that gets passed around in the HTTP header when setting cookies. ...
2
votes
2answers
63 views

CAPTCHA code refreshing vulnerability

Question is not programmatic but rather conceptual. When a user is trying to fill in a contact form and then CAPTCHA code, if he/she accidentally refreshes the page or doesn't fill a required input ...
2
votes
2answers
32 views

Testing non‐browser‐based https clients for Poodle

I have a command line tool that can download any URLs likewget (only for vcs systems) but not it’s source code, how can I test if it is vulnerable to POODLE? There are lot of online automated tools ...
2
votes
1answer
76 views

Is SSL really insecure on most of the web? This report seems to suggest so [duplicate]

The Wikipedia article on TLS article has a tremendously long list of attacks against SSL. A table on that article shows a survey from September 2015. If you look at that survey, it shows that nearly ...
2
votes
1answer
371 views

302 redirect and the body on the page (you are redirected to …)

I have page which take URL on query and string and it. Then, you get redirected using 302 to another page, and the response of the page contains HTML code and the redirect header. Like this: <html&...
2
votes
1answer
44 views

Is this system of authentication secure for a mobile app? What can I do to improve it?

Users authenticate with their phone number, get a pin text, and if it is correct, they get an access token. Store the access token in a DB in a Token model. The client always sends the access token in ...
2
votes
1answer
320 views

Server side validations for file upload to prevent DoS on HTTP server

I am aware that client side validations can be easily bypassed by means like disabling javascript. I would like to know the things to be checked while doing a server side validation for file upload. I ...
2
votes
1answer
1k views

CSRF-protection using authentication token in HTTP header

I'm working on a web application which stores an authentication token in a cookie. The only CSRF-protection is referrer checking. I am considering improving this by moving the authentication token ...
2
votes
1answer
119 views

Danger of having my website make arbitrary web requests

I'm setting up a small code-hosting web site, in the vein of github or bitbucket. I would like to allow users to specify an arbitrary URL from which my site's server will initially clone their ...
2
votes
2answers
302 views

Indirectly relaying intranet server to outside world

I have an internal network of IP network cameras. The feeds from these cameras are ingested by a single server and presented from a unified web interface both internally and to the outside world (both ...
2
votes
1answer
963 views

What method for CSRF token generation should I use in my scenario?

I'm working on a RESTful API to work with my AngularJS application. Authenticating works by generating an ASP.NET FormsAuthenticationTicket. It is stored in a cookie using FormsAuthentication.Encrypt....
2
votes
1answer
1k views

Are there any vulnerabilities when making cross-domain HTTP requests during an SSL connection?

I recently starting using the Calomel SSL Validation plugin for Firefox to test the SSL security on the sites I visit. When navigating to American Express' log in page, I noticed Calomel reports the ...
2
votes
1answer
389 views

Route traffic from iPhone to desktop and back

I have some iOS app to pentest, and the target server is accessible only through the jailbroken iPhone's APN. My problem is, that I want to configure the traffic in such way so I can intercept and ...
2
votes
1answer
107 views

What's the best way to enumerate log/sign in attempts?

For sign in via a website, what is the best way to count the number of attempts that is: least vulnerable to tampering reliable quick The system would: use HTTPS throughout the sign on phase (at ...
2
votes
4answers
1k views

Should links to images contained in emails be secure?

We are generating emails which contain links to images: our client's branding, images showing other products offered by the client etc... What are the security pitfalls if these links in the emails ...