An application that is accessed over a network such as the Internet or an intranet using a browser.
10
votes
2answers
582 views
What are the SQL-injections issues of parameterized queries?
I've written some code to generate an SQL query in ASP classic. I'm not sure if it's secure or not:
Set adoCon = Server.CreateObject("ADODB.Connection")
adoCon.Open "Provider=Microsoft.Jet.OLEDB.4.0; ...
10
votes
6answers
925 views
Is there a security risk running web apps in debug=“true”?
This is a copy of the original question on Stack Overflow which didn't get much love and is probably more relevant here:
There are plenty of performance reasons why apps shouldn't be run in ...
10
votes
3answers
297 views
Should I ask a user to re-authenticate if the browser thumbprint changes? Is a server side library available?
Is there a security benefit to using the browser's thumbprint in addition to a session identifier to identify a unique session?
Would it then be advisable to ask the user to reauthenticate (or simply ...
10
votes
2answers
149 views
Preventing Voter Fraud on a Social Media Contest
I'm creating a contest that will allow users to login using their Facebook & Twitter accounts and submit votes on videos. My clients concern is that users will game the system by logging into ...
10
votes
1answer
1k views
enable browser caching with HTTPS
I understand that sensitive data should not be cached (ie, you dont want to cache an HTML file with all of your bank account details in it), but there are some things that HTTPS protected sites should ...
10
votes
3answers
441 views
How much information about the reason for an unsuccessful login should a web application give?
After an unsuccessful login attempt, should I inform the user about its reason? Or more generally, how much information about the reason for an unsuccessful login attempt should a web application ...
10
votes
4answers
2k views
https security - should password be hashed server-side or client-side?
I am building a web application which requires users to login. All communication goes through https. I am using bcrypt to hash passwords.
I am facing a dilemma - I used to think it is safer to make a ...
10
votes
1answer
336 views
Public XSLT & XML playground (with PHP DOMDocument, etc.) Security Risks?
Let's say I want to set up a sandbox or playground in PHP that users can use to create (or paste in) XML and XSLT, then transform the XML via the XSLT (by means of PHP 5's DOMDocument and related ...
10
votes
2answers
414 views
Security quiz for developers
Does anyone know of a short security quiz that could be administered online, to test the security knowledge of a developer? I'm looking for something simple to administer and simple to grade, ideally ...
10
votes
1answer
1k views
Guidance for implementors of HTTPS-only sites (Server side)
The recent trend in HTTPS attacks is to attack the HTTP protocol. What should I do to increase my site's security if the only protocol I want is HTTPS?
Some easy to implement ideas are
Implement ...
10
votes
2answers
743 views
What is the point of the same-domain rule for xmlhttprequest when script tags/JSONP can cross domains?
I get that I don't want a page loaded from stackoverflow.com to be able to request gmail.com on my behalf and read my email--but this seems to be simply a cookie issue.
Since JSONP bypasses ...
10
votes
1answer
390 views
How can I embed iframe securely without restricting its functionality?
I'd want to embed an iframe from untrusted site into web application. Iframe:
should be able to run Javascript and browser plugins (Flash, etc.)
should not be able to access my web application ...
10
votes
1answer
1k views
Best way to secure javascript front end/REST back end architecture web site?
I would like to build the following project:
public REST API back end which can be accessed by any authenticated client.
front end with static files in HTML/CSS/Javascript with Backbone.js jQuery ...
9
votes
6answers
424 views
What are web attacks which users can run code on your servers?
I hear stories about insecure web servers and sites which people (or bots) break into and execute their own code on the server.
My question is how is that possible? I heard of people putting their ...
9
votes
7answers
510 views
IP address black list
My website has a black list of IP addresses. The web application, in some way, detects all invalid, suspicious influences to it and remembers IP address and denies any requests from that IP address. ...
9
votes
3answers
146 views
What simple security considerations can I / should I make for a read-only API?
Right now I'm setting up an API, to be consumed on the client-side to set up a directory site. I'm wondering what extra steps I need to take just to prevent people from gaining write access to the ...
9
votes
4answers
2k views
Session Hijacking - regenerate session ID
Does regenerating the session ID on each request mitigate the probability of a session hijack enough to be worth implementing?
I would imagine combining a check for REMOTE_ADDR vs the REMOTE_ADDR ...
9
votes
3answers
845 views
Asp.net mvc security check list
I am planning to start a new web site on asp.net mvc 2 (3).
Have anybody a full (if possible) check list of actions, approaches I should reach to avoid almost problems with security.
9
votes
4answers
530 views
Is there a typical step-by-step A-Z process for testing a Web site for possible exploits?
I'm interested less in the tools of the trade (there are many questions here already about that), and I am interested more in the process by which you would go about using those tools. So for ...
9
votes
3answers
772 views
localStorage for apps over https. What expectations are there?
I run an online gradebook. To keep student data private, I transfer all data over https.
Now, I'd like to use localStorage to avoid redundant calculations and server requests. However, according to ...
9
votes
4answers
944 views
What are the disadvantages of single sign-on authentication?
We were discussing to implement single on in our web application,right now after analyzing we came to know that the following were the advantages of single sign on authentication.
Advantages
Users ...
9
votes
1answer
261 views
Is there a web application firewall equivalent of virustotal?
I'm wondering if there is a web application firewall (WAF) equivalent of VirusTotal? A site where I can throw for example injection strings, exploits or xss, and it will tell me what the default ...
9
votes
2answers
167 views
Is request signing (digesting the request body) in a REST API necessary?
I am currently engaged in a debate and I wondered what the community's opinion on this was.
We see REST APIs which just require basic authentication (perhaps HTTP) or OAuth.
We see REST APIs which ...
8
votes
7answers
926 views
Whitelisting DOM elements to defeat XSS
As we know, developers are responsible for correctly escaping/validating data provided by the user before rendering or storing them. However, we must agree that it's relatively easy to forget a single ...
8
votes
7answers
294 views
Aren't permanantly logged in accounts inherently insecure?
The basic premise behind a "keep me logged in until I log out" feature is a cookie is stored with some identifier that is used to log the user in again when returning to the site. While these ...
8
votes
4answers
729 views
Is $_SERVER[ ] a safe source of data in PHP?
Can I 100% rely on $_SERVER[] to be a safe source of data that I do not need to sanitized like I do $_GET[] and $_POST[]?
Thanks.
OVERVIEW OF RESPONSES:
So it seems there is a consensus that some ...
8
votes
9answers
345 views
What is the proper way to view the sourcecode of a website?
I recently heard that Firefox makes a second HTTP request when the sourcecode is requested. Is this true?
Does this mean the webserver may issue alternate source from the original?
Lastly, is ...
8
votes
2answers
2k views
ssltest: Chain issues - Contains anchor
I've run ssltest on web application and it found "Chain issues - Contains anchor" (section "Additional Certificates (if supplied)")
What does it mean? Should it be fixed? Can it be exploited?
8
votes
5answers
721 views
What is a DoS Attack and how does it differ from a DDoS attack?
Can some one explain to me the concept of Dos Attacks for web applications ? Also what is the distinction between Dos and Distributed Dos ( ie DDos) attacks ? Wikipedia says :
In computing, a ...
8
votes
3answers
411 views
How does an attacker approach a website?
What is a typical mindset and method of approach? What are they likely to try first? At what point does a novice give up versus an expert? How would an automated attack differ from a manual one?
8
votes
3answers
296 views
Does concealing server software versions have a notable effect on security?
Web servers can add Server, X-Powered-By and similar headers into HTTP responses. Looks like the consensus is such headers should be removed so that automatic vulnerability scanners don't immediately ...
8
votes
3answers
973 views
Is it possible to forge a post request?
Consider the following URL http://mysite.com/form?date=x. Suppose that if x is in an incorrect format, that a page is returned with <p>x is not a valid date</p>, where the page author has ...
8
votes
3answers
670 views
How do I secure my SaaS startup?
I came across this question
I like to offer my startup also for security advice.
Objective: building a SaaS web application that allows businesses to quickly open up online stores akin to Yahoo! ...
8
votes
2answers
286 views
What is secure enough for web applications?
we intend to build a network in a small health center with No Internet Access
it is expected to have 30 terminal machines, all machines will use an electronic medical record web application
we want ...
8
votes
4answers
202 views
When changing a password using a WebPage, must the old password be entered on the same screen?
There is a convention to always prompt for the old password on the same page as the one where the old password is being changed as shown below.
Is it acceptable from a security perspective to allow a ...
8
votes
6answers
966 views
How do I get started with security? (beginner) [closed]
I have been working in web development for a fair amount of time. I am looking at developing in either Python (Django etc.) or PHP. I am new to security. Where do I begin looking? What are basic ...
8
votes
2answers
605 views
Security Concerns on clientside(Javascript)
We are going to design and implement a UI for a big website. Owner of the site is really cautious about security issues. I wonder if there is a check list for security issues at the client-side ,while ...
8
votes
2answers
209 views
Is there any risk related to allow user to give an URL as their image profile?
Building a website, I'd like to allow users to specify an url that point to an image that will be used as a profile picture (included in the HTML DOM as a ).
But before doing anything stupid, I was ...
8
votes
2answers
180 views
Isolating Web application hosted on same web server
I am working on a scenario if we have two or more web application hosted on a same server. Let says Web application X is vulnerable so how can i be sure that it will not effect the other web ...
8
votes
4answers
309 views
Preventing insecure webapp on subdomain compromise security of main webapp
I want your help on getting more concrete information on a type of vulnerability that I remember vaguely.
I vaguely remember hearing about a year ago that if you set up a webapp on a subdomain, and ...
8
votes
2answers
2k views
Is doing credit card transaction via 3G secure?
3G, GPRS or other mobile-based connection. Because it seems like it's easier to intercept, than, say, land-based connection or encrypted WiFi. If it matters, the transaction I want to perform is ...
8
votes
4answers
694 views
What is the right way of storing database connection strings from the security point of view?
What are recommendations, best practices and have-to-dos regarding handling connection strings in web applications? What things one should never, ever do?
8
votes
2answers
482 views
Recent Facebook XSS exploit details
There was a recent XSS exploit on Facebook that posted a vulgar message and got users to click on a link to spread the payload. What vulnerability was exploited, and what can other sites do to avoid a ...
8
votes
3answers
407 views
Database Encryption Security
I am encrypting and decrypting my database data from my web applications API. If my web server is compromised, what is to keep someone from using that same method to retrieve the data?
For example, ...
8
votes
3answers
326 views
AES using derived keys / IVs. Does it introduce a weakness?
I'm looking for an efficient way to encrypt multiple fields in a database with AES using a single global key, used throughout a large web application.
Obviously in order to re-use this key, a unique ...
8
votes
2answers
549 views
MIME sniffing protection
As it is known, older versions of MSIE (before 8) have a nasty habit of treating images as HTML if they "look like" HTML, which can lead to nasty vulnerabilities for sites that allow people to upload ...
8
votes
3answers
321 views
What security features should be present in every web-based CMS?
What are the most important security features that a web-based CMS should offer? What's vital? What would be nice to have? What features should the CMS not attempt to do?
Please note: I'm looking ...
8
votes
2answers
205 views
User-specific Subdomains : JavaScript security
If I provide a public-facing website for users on my website at their own subdomain (e.g. bob.myapp.com) under their own control, can I allow them to execute arbitrary JavaScript without putting my ...
8
votes
2answers
726 views
Keeping user session alive - security considerations
We have recently developed some functionality for our web app to allow a user to remain logged in indefinitely, and are interested in knowing the security ramifications of doing so. The goal of this ...
8
votes
2answers
831 views
How secure are the default ASP.NET membership and role providers for Sql Server?
I have a very basic idea of how these work. I've used them many times when I needed a user management system rather then writing my own. But should I use these for a production system? Would ...
