An application that is accessed over a network such as the Internet or an intranet using a browser.

learn more… | top users | synonyms

2
votes
2answers
939 views

Is it possible to take down a site using javascript in the URL bar?

If a site is written poorly enough, is it possible to take it down or severely mess with it using only javascript in the URL bar?
3
votes
2answers
224 views

How does LiveID work? Is there any documentation on the LiveID provisioning site msm.live.com?

I'm trying to learn details on how LiveID works, when compared to other federation technologies. To be honest, I'm a bit overwhelmed by all the options at https://msm.live.com/ and want to understand ...
3
votes
3answers
3k views

What is the exact difference between SAMLp and WS-Trust?

They seem to be similar on the surface, but I'm not sure how deep the differences are. Can someone explain to me the difference between SAMLp and WS-Trust? ADFSv2 gives me a choice between these ...
0
votes
1answer
806 views

How can I decrypt ADFS-based SAML/p or WS-Trust claims?

I'd like to audit the claims that are sent to a client from a SAML/p or WS-Trust authentication. What private keys do I need and how would I decrypt this information? If it makes any difference, I'm ...
3
votes
3answers
3k views

How does a website owner decrypt ASP.NET's Viewstate, and cookies

I'd like to audit my viewstate for information I don't want to be sent down to the client. What are the steps needed to decrypt this information into human readable form? How would I decrypt the ...
2
votes
3answers
121 views

Is it necessary to protect user data if they know and agree to it being insecure?

If I'm running a website that, say, takes a survey, must I protect user data from disclosure if the users are informed initially that it's insecure? I'm not storing financial data or social security ...
8
votes
3answers
688 views

How does an attacker approach a website?

What is a typical mindset and method of approach? What are they likely to try first? At what point does a novice give up versus an expert? How would an automated attack differ from a manual one?
4
votes
2answers
319 views

FrameBusting script

It is commonly known that loading your site inside a frame on another site, can potentially expose your site to all kinds of ills, and in general is not a good idea if you have any sensitive data to ...
5
votes
3answers
460 views

Is randomizing cookie names a good idea?

What security benefits would randomizing cookie names on a website offer? What are some of the challenges it would create?
5
votes
2answers
389 views

What protects cookies?

What protects cookies from being stolen? After all, they are just text files. A misbehaving browser can give up a lot more information that web masters would like. How do I know that a browser won't ...
3
votes
2answers
901 views

Encrypting a Database's Primary Key when sent to the browser

When dealing with either an oData-based application (ADO.NET Data Services), or something that otherwise publishes the PrimaryKey, or ForeignKey to the client... Can someone explain to me be benefits ...
21
votes
3answers
7k views

What are the best practices for hardening a php.ini file?

In order to secure a PHP installation, what are the best settings for a php.ini file? What is absolutely vital in terms of security? What is recommended for most use cases?
14
votes
4answers
679 views

Database Encryption Security

I am encrypting and decrypting my database data from my web applications API. If my web server is compromised, what is to keep someone from using that same method to retrieve the data? For example, ...
12
votes
4answers
682 views

What does defense in depth entail for a web app?

I'm assuming it means different layers of security from app-level security to server hardening to personnel training, but what are each of those layers and what are some good resources for each level ...
21
votes
5answers
5k views

What are the security risks of letting the users upload content to my site?

As a web designer (not a security expert) I wonder: If I allow users to upload content to my website (videos, images and text files), what are the real risks involved?
21
votes
7answers
1k views

How can I protect a WordPress installation?

How do you go about protecting a default WordPress installation? What checklist do you use, best practices, tips and tricks, etc? Any recommendations on plugins, third-party tools are welcome.
15
votes
7answers
348 views

Is a “security measure” that doesn't provide a security benefit actually harmful?

If a security measure is implemented that doesn't provide any additional security benefit, can it be considered harmful? As an example, consider a login page where the user is asked to enter their ...
16
votes
1answer
3k views

What is a Web Application Firewall?

What is a Web Application Firewall (WAF) and what are some of the things to look for in an effective one? Why would you deploy a WAF instead of just an IPS?
15
votes
5answers
610 views

What are the most important security checks for new web applications?

I'm wondering what are the top priority security checks you should make befor launching a new webapp? I'm guessing brute force vulnerabilities and cross-site scripting. What are the other things you ...
14
votes
2answers
1k views

How can I test my web application for timing attacks?

race conditions, etc. Are there automatic tools for this? What manual techniques should I use? From the Area51 proposal
21
votes
3answers
2k views

Pitfalls of using OAuth for mobile Applications

OAuth seems to be getting a lot of traction at the moment as an authorization solution for web applications and mobile applications. I'm interested in understanding what the pitfalls of using OAuth ...
9
votes
3answers
612 views

What security features should be present in every web-based CMS?

What are the most important security features that a web-based CMS should offer? What's vital? What would be nice to have? What features should the CMS not attempt to do? Please note: I'm looking ...
10
votes
4answers
4k views

How effective are reverse proxies as a web application security measure?

How effective are reverse proxies as a web application security device? Which types of threats do they mitigate against and which don't they? For example are they more effective in preventing ...
62
votes
13answers
16k views

What are the pros and cons of site wide SSL (https)?

What are the pros and cons of encrypting all HTTP traffic for the whole site through SSL, as opposed to SSL on just the login page?
10
votes
3answers
838 views

If I am obliged to store a password/certificate on a client side, how can i make sure that it is protected?

In certain cases we need to establish a key/password/certificate as a first timer and then as a client we need to use this key/password/certificate to get authenticated. Therefore the ...
8
votes
1answer
619 views

Are browser still vulnerable to Cross-Site Cooking?

The latest article that I have been able to find about Cross-Site cooking was stating that it was possible to set cookie on 2 dots top level domain such as .co.uk. The mechanism for preventing ...
26
votes
2answers
3k views

How can a Software application defend against DoS or DDoS?

Most of the solutions for DoS attacks are not at the application level. In case I am using a proxy server, what are the possible countermeasures for DoS at the application level?
9
votes
4answers
342 views

Defending site against being abused by phishing

Say you have a web site and you are using some returnUrl URL parameter to redirect user back to page where he was after login or editing some records in user area. Is there some standard way how to ...
22
votes
5answers
15k views

What is the correct way to implement anti-CSRF form tokens?

I am fully aware of CSRF and have already implemented some safe forms, but I have never been happy with the results yet. I've created tokens as a md5 of username, form info and a salt and stored it ...
22
votes
4answers
641 views

How does using OpenID affect webapp security?

Using OpenID for authenticating users grows in popularity and, in fact, makes a webapp easier to use. But what are the security considerations one should bear in mind when deciding whether to ...
3
votes
2answers
1k views

Web Crawler for ASP.NET site

Do you know any crawler/spider software, which is able to go through ASP.NET application, not ASP.NET MVC, but the one full of __doPostBack JavaScript functions on every link/button/change event? If ...
11
votes
4answers
2k views

What is the right way of storing database connection strings from the security point of view?

What are recommendations, best practices and have-to-dos regarding handling connection strings in web applications? What things one should never, ever do?
20
votes
7answers
4k views

What are some good website security scanning solutions?

What are some good web-based website security scanning solutions? I'm not too concerned if they are web-based solutions, or software that can be run locally. Generally, I'm looking for something we ...
7
votes
4answers
307 views

How to determine whether site is secure from common user's point of view?

What should be done (or at least declared) so end-users, visitors will start trusting your website? Some thoughts: secured login (via https) privacy policy (hidden email and other private ...
11
votes
7answers
839 views

IP address black list

My website has a black list of IP addresses. The web application, in some way, detects all invalid, suspicious influences to it and remembers IP address and denies any requests from that IP address. ...
39
votes
5answers
7k views

How to Securely Implement a “Remember Me” Feature?

Assuming you already have a website that implements all of the standard login stuff, what is the correct and most secure way to allow users to automatically be logged in for a certain time period ...
12
votes
3answers
1k views

Asp.net mvc security check list

I am planning to start a new web site on asp.net mvc 2 (3). Have anybody a full (if possible) check list of actions, approaches I should reach to avoid almost problems with security.
21
votes
5answers
3k views

Should I use Suhosin for PHP?

Suhosin can be used to increase the security of your php application. I can really see the use of it when you are using shared hosts, with multiple (possibly evil) people running their PHP apps ...
77
votes
17answers
11k views

Does an established ssl connection mean a line is really secure

From the view of somebody offering a webapplication. When somebody connects with SSL (https) to our service and submits the correct authentication data, is it safe to transmit all sensitive data over ...