An application that is accessed over a network such as the Internet or an intranet using a browser.
53
votes
12answers
3k views
Does an established ssl connection mean a line is really secure
From the view of somebody offering a webapplication. When somebody connects with SSL (https) to our service and submits the correct authentication data, is it safe to transmit all sensitive data over ...
38
votes
11answers
4k views
What are the pros and cons of site wide SSL (https)?
What are the pros and cons of encrypting all HTTP traffic for the whole site through SSL, as opposed to SSL on just the login page?
49
votes
8answers
5k views
Can anyone provide references for implementing web application self password reset mechanisms properly?
We are implementing self password reset on a web application, and I know how I want to do it (email time limited password reset URL to users pre-registered email address).
My problem is that I ...
43
votes
6answers
3k views
Can anybody explain XSS to an idiot?
That idiot being me, of course.
I work programming Enterprise Java applications and do very little web development in 2002. I'm interested in security and like to read articles about it. However, I ...
31
votes
2answers
3k views
Is a rand from /dev/urandom secure for a login key?
Lets say I want to cookie for a user, would simply going to /dev/urandom, generating a 1024 bit string, checking if it already exists (and looping till I get a unique one) suffice? Or should I be ...
15
votes
1answer
839 views
What cookie attacks are possible between computers in related DNS domains (*.example.com)?
Here, several servers in the same DNS domain emit cookies under a variety of settings (scope, HTTPS, Secure) and another host emits a cookie with the same value.
Example
Suppose a user has the ...
7
votes
3answers
970 views
Using file extension and MIME type (as output by file -i -b) combination to determine unsafe files?
We allow users to upload a number of files, all of which we either send over to scribd (doc, xls, ppts, etc) or display as a video ourselves (flv, mov, mp4, etc in flowplayer).
To avoid users ...
12
votes
4answers
360 views
Is it safe to store and replay user-provided mime types?
If a user uploads a file but modifies the request by setting the mime-type to something arbitrary, like "superdangerous/blackhatstuff", is it safe for me to send the same mime type back to a different ...
17
votes
5answers
846 views
Can you secure a web app from FireSheep without using SSL?
Assume that you want to give some web users privileged access to your website, but that you are unable (or unwilling) to offer SSL to all of them - at least past the initial login page.
In this ...
10
votes
1answer
1k views
Guidance for implementors of HTTPS-only sites (Server side)
The recent trend in HTTPS attacks is to attack the HTTP protocol. What should I do to increase my site's security if the only protocol I want is HTTPS?
Some easy to implement ideas are
Implement ...
19
votes
2answers
2k views
How can a Software application defend against DoS or DDoS?
Most of the solutions for DoS attacks are not at the application level. In case I am using a proxy server, what are the possible countermeasures for DoS at the application level?
10
votes
3answers
1k views
What are the security risks of letting the users upload content to my site?
As a web designer (not a security expert) I wonder: If I allow users to upload content to my website (videos, images and text files), what are the real risks involved?
4
votes
6answers
596 views
Filter user input before the database or upon display?
Given a web application where user data must be properly escaped to avoid XSS, is it better to try to remove the "bad stuff" before it enters the database, or is it best to allow it in the database ...
16
votes
7answers
604 views
Protecting WordPress installations
How do you go about protecting a default WordPress installation? What checklist do you use, best practices, tips and tricks, etc? Any recommendations on plugins, third-party tools are welcome. Thanks.
...
18
votes
14answers
1k views
How can you become a competent web application security expert without breaking the law?
This question was asked here on Programmers Exchange, but it was suggested I ask here as well since most of the experts would likely hang out on IT Security exchange instead.
I find this to be ...
15
votes
3answers
2k views
Should I have a maximum password length?
I'm creating a webapp, and part of my authentication method is password length.
Should I put one in place? (say, 50 characters?) Or should I just put a minimum length (Currently at 6).
Are there ...
34
votes
7answers
9k views
Is BASIC-Auth secure if done over HTTPS?
I'm making a REST-API and it's straight forward to do BASIC auth login. Then let HTTPS secure the connection so the password is protected when the api is used.
Can this be considered secure?
17
votes
3answers
3k views
What are the best practices for hardening a php.ini file?
In order to secure a PHP installation, what are the best settings for a php.ini file? What is absolutely vital in terms of security? What is recommended for most use cases?
11
votes
4answers
4k views
What is the correct way to implement anti-CSRF form tokens?
I am fully aware of CSRF and have already implemented some safe forms, but I have never been happy with the results yet.
I've created tokens as a md5 of username, form info and a salt and stored it ...
3
votes
4answers
477 views
Can a CSRF CAPTCHA be defeated?
One defense that developers use to protect against a CSRF attack is to implement a CAPTCHA in critical steps. A CAPTCHA ensures that a human is at the keyboard approving the activity. But I've ...
25
votes
5answers
2k views
How to Securely Implement a “Remember Me” Feature?
Assuming you already have a website that implements all of the standard login stuff, what is the correct and most secure way to allow users to automatically be logged in for a certain time period ...
8
votes
6answers
911 views
How do I get started with security? (beginner) [closed]
I have been working in web development for a fair amount of time. I am looking at developing in either Python (Django etc.) or PHP. I am new to security. Where do I begin looking? What are basic ...
4
votes
2answers
377 views
Beginners materials for web security [duplicate]
Possible Duplicate:
Resources to learn about security
What materials can I study to learn web development security. I'm a web developer, I use ASP.NET, Java, PHP, and JavaScript. I want to ...
23
votes
5answers
1k views
Why is HTTPS not the default protocol?
Why is HTTP still commonly used, instead what I would believe much more secure HTTPS?
11
votes
5answers
2k views
Could mint.com be more secure, and if so, how?
After reading a bit about mint.com on the money stack exchange, I wanted to give it a try. But frankly, it scares me a little bit.
The site has a bunch of links explaining how they're so secure. I ...
4
votes
6answers
575 views
Best resources to learn web security attacks? [closed]
Can anyone suggest good resources to learn about vulnerabilities in and attacks on web sites, in a hands-on way, for someone with limited programming experience?
17
votes
8answers
741 views
How to protect against brute forcing
How do you properly implement defenses against brute forcing? Is it best to store how many times someone tried to log in and block them after X attempts? And how would "someone" be identified? With ...
7
votes
3answers
505 views
Security attacks on PHP web applications
I know about following security attacks on php applications (html,php,js).
XSS
SQL Injection
CSFR
Session Hijacking /Fixation
Code Injection
Remote file injection
Should i know about any other or ...
32
votes
11answers
3k views
What to do about websites that store plain text passwords
I recently received an email from a popular graduate job web site (prospects.ac.uk) that I haven't used in a while suggesting I use a new feature. It contained both my username and password in plain ...
10
votes
3answers
4k views
Is the Facebook login form using SSL without https in the URL?
If I go to http://facebook.com, I am not redirected to https://www.facebook.com. If it doesn't have https in the URL, can the login be secure? Usually I am redirected to an https page on other sites? ...
8
votes
2answers
513 views
MIME sniffing protection
As it is known, older versions of MSIE (before 8) have a nasty habit of treating images as HTML if they "look like" HTML, which can lead to nasty vulnerabilities for sites that allow people to upload ...
2
votes
3answers
3k views
Does X-Content-Type-Options really prevent content sniffing attacks?
In Tangled Web Michal Zalewski says:
Refrain from using Content-Type: application/octet-stream and use application/binary instead, especially for unknown document types. Refrain from returning ...
7
votes
3answers
357 views
Is a mobile app more secure for mobile use than the “normal” website?
An untrained end user who uses a mobile web browser is vulnerable to phishing and can't easily verify the the authenticity (or security) of a website among other issues. Also, it is very easy to ...
23
votes
6answers
1k views
Is there a difference between GET and POST for web application security?
I have 2 choices in sending data between 2 web applications.
I encode the data in Base64 and append to the URL and retrieve these parameters at my destination application and decode the parameters.
...
13
votes
4answers
748 views
Web Security Cheatsheet / ToDo list
Can anyone suggest a cheatsheet or ToDo list of web site and application security?
A local small business owner prompted a question about web security, basically her company website just got XSS ...
21
votes
9answers
1k views
Why do some people really hate security via client-side?
For instance, lets look at a common login system for a website
HTTPS connection is made
User submits credentials via POST
Server-side code hashes the password and looks if it matches the user name
...
15
votes
7answers
692 views
If I include a Forgot Password service, then what's the point of using a password?
I've implemented a Forgot Password service in the following way:
User goes to login page, clicks on "Forgot password?"
User is presented with a form that asks for their email address.
Email is sent ...
15
votes
2answers
347 views
What risks should I be aware of before allowing advertisements being placed on my website?
The thought of having a 3rd party send javascript, and images to end users seems to be a scary thought, but that is exactly what we are doing when I place advertisements onto my site.
Does serving ...
6
votes
1answer
3k views
Why is it so hard to close onion domains (e.g. The Silkroad)?
A few months ago when I started to experiment with bitcoin I came across The Silkroad (only accessible via Tor)
For those who do not know what Tor is and who do not want to waste their time ...
26
votes
5answers
2k views
Are GUIDs safe for one-time tokens?
I see a lot of sites use GUIDs for password resets, unsubscribe requests and other forms of unique identification.
Presumably they are appealing because they are easy to generate, unique, ...
20
votes
8answers
2k views
Is anybody using client browser certificates?
Client browser certificates seem to be a nice way to protect sites from intruders - it is impossible to guess and should be harder to steal. Of course, they do not solve all the problems, but they add ...
13
votes
4answers
789 views
Is AJAX fundamentally insecure?
Possible Duplicate:
How to do Ajax securely?
At my workplace many people believe that AJAX is fundamentally insecure. I am under the impression that AJAX is exactly as secure as any other ...
11
votes
5answers
1k views
Solution to allow JavaScript input but prevent XSS
We have a simple Blog system that allows users to input html and JavaScript to build a blog page. I'm aware that allowing javascript open up the door to xss attacks. We do however need to allow users ...
7
votes
4answers
911 views
Challenging challenge: client-side password hashing and server-side password verification
We have a website where users need to log in to access privileged information. Obviously we are using SSL, but I also want to avoid plaintext passwords from accidently ending up in server logs, or ...
7
votes
3answers
176 views
Securing an E-commerce site
I'm building a custom e-commerce site, and the user will input their credit card details on the site instead of being directed to the payment gateway's site.
I'm confused as to what the critical ...
6
votes
4answers
860 views
Escaping JavaScript constants
how can untrusted values be included in a html-page as javascript string constants? Although the case i am asking uses JSF and Rails, I think this is a general problem independent of the server side ...
5
votes
3answers
1k views
Is it possible to inject HTML into image to provoke XSS?
Some answers mention that it's possible to inject attacker-controlled HTML into images and therefore provoke XSS.
I guess that this HTML will be processed by browser only if hole exists in browser. ...
5
votes
2answers
688 views
HTML 5 Security Code Scanner
Are there code scanners in the market that scan HTML 5 code?
Does anyone have a list of tags of specific CORS configurations that need/can be scanned?
11
votes
3answers
274 views
Malicious QR Code and Mitigation
I just started reading a little on QR code, so I'm not entirely familiar with QR Code capabilities, but a thought crossed my mind today.
I scanned a QR Code on a postcard I received, and it ...
10
votes
4answers
2k views
https security - should password be hashed server-side or client-side?
I am building a web application which requires users to login. All communication goes through https. I am using bcrypt to hash passwords.
I am facing a dilemma - I used to think it is safer to make a ...
