An application that is accessed over a network such as the Internet or an intranet using a browser.

learn more… | top users | synonyms

227
votes
16answers
50k views

SQL injection is 17 years old. Why is it still around?

I'm no techie and would like your expertise in understanding this. I recently read a detailed article on SQLi for a research paper. It strikes me as odd. Why do so many data breaches still happen ...
159
votes
8answers
76k views

Is BASIC-Auth secure if done over HTTPS?

I'm making a REST-API and it's straight forward to do BASIC auth login. Then let HTTPS secure the connection so the password is protected when the api is used. Can this be considered secure?
152
votes
2answers
95k views

What is the difference between https://google.com and https://encrypted.google.com?

Is it there any difference between the encrypted Google search (at https://encrypted.google.com) and the ordinary HTTPS Google search (at https://google.com)? In terms of security what were the ...
126
votes
3answers
22k views

Is a rand from /dev/urandom secure for a login key?

Lets say I want to create a cookie for a user. Would simply generating a 1024 bit string by using /dev/urandom, and checking if it already exists (looping until I get a unique one) suffice? Or should ...
95
votes
17answers
15k views

Does an established SSL connection mean a line is really secure?

From the view of somebody offering a web application, when somebody connects with SSL (https) to our service and submits the correct authentication data, is it safe to transmit all sensitive data over ...
86
votes
8answers
8k views

Do we need to logout of webapps?

A quick Google search doesn't reveal whether it is important to logout of webapps (online banking, Amazon, Facebook, etc.), or if I am safe just closing the tab or browser. I am sure I heard on some ...
79
votes
8answers
11k views

Can anyone provide references for implementing web application self password reset mechanisms properly?

We are implementing self password reset on a web application, and I know how I want to do it (email time limited password reset URL to users pre-registered email address). My problem is that I can'...
79
votes
5answers
38k views

Should websites be allowed to disable autocomplete on forms or fields?

Currently, there is an HTML form/input attribute called autocomplete, which, when set to off, disables autocomplete/autofill for that form or element. Some banks seem to use this to prevent password ...
77
votes
6answers
9k views

How to find out what programming language a website is built in?

I think that it's fundamental for security testers to gather information about how a web application works and eventually what language it's written in. I know that URL extensions, HTTP headers, ...
76
votes
4answers
28k views

Why is the same origin policy so important?

I can't really fully understand what same origin domain means. I know it means that when getting a resource from another domain (say a JS file) it will run from the context of the domain that serves ...
75
votes
4answers
12k views

Can anybody explain XSS? [closed]

I work programming Enterprise Java applications and do very little web development in 2002. I'm interested in security and like to read articles about it. However, I never fully understand how XSS ...
69
votes
2answers
36k views

ssltest: Chain issues - Contains anchor

I've run ssltest on web application and it found "Chain issues - Contains anchor" (section "Additional Certificates (if supplied)") What does it mean? Should it be fixed? Can it be exploited?
68
votes
13answers
22k views

What are the pros and cons of site wide SSL (https)?

What are the pros and cons of encrypting all HTTP traffic for the whole site through SSL, as opposed to SSL on just the login page?
64
votes
10answers
6k views

Does disabling right click have any impact on security?

On a banking website I see that they have disabled right-click. Does that make the site any more secure? Is it a good general practice?
64
votes
7answers
29k views

SQL injection — why isn't escape quotes safe anymore?

Raw SQL When you're writing SQL -- for anything that takes human input really, a lot of things have been done to avoid the injection. Everyone that's heard of SQL injection knows that (I'm going to ...
64
votes
12answers
14k views

What to do about websites that store plain text passwords

I recently received an email from a popular graduate job web site (prospects.ac.uk) that I haven't used in a while suggesting I use a new feature. It contained both my username and password in plain ...
63
votes
5answers
10k views

HTTPS web service switched to HTTP. What can go wrong?

I recently visited a website which used to have an HTTPS connection. Now it has just a plain HTTP connection, and the authentication method has changed from user+password to "authenticate with Google ...
63
votes
16answers
51k views

What tools are available to assess the security of a web application?

What tools are available to assess the security of a web application? Please provide a small description of what the tool does. Update: More specifically, I'm looking for tools that assume no ...
62
votes
8answers
6k views

Is there any reason to disable paste password on login?

This is a question I asked in ux stackexchange but I wanted an answer from information security perspective too: Today I logged in to pay my cellphone bill, and I found that the site has disabled ...
61
votes
10answers
18k views

Bad practice to have a “god” password?

Is it bad security practice to have a password that will allow you to access any user account on a website for support purposes? The password would be stored in a secure manner and would be super ...
58
votes
1answer
3k views

“Allow __ to be fullscreen?”

I have been asking myself for a while what's the purpose of that popup showing up in pretty much all the modern browsers upon entering the full-screen mode of a video or website. It appears to be a ...
55
votes
7answers
7k views

Are there security advantages gained from forcing a website to be available from just one tab at a time?

I just found that a website of one Polish bank forces the users to open it in one browser tab only. You cannot for example check your transfer history while looking for an account number that you ...
52
votes
5answers
11k views

Are GUIDs safe for one-time tokens?

I see a lot of sites use GUIDs for password resets, unsubscribe requests and other forms of unique identification. Presumably they are appealing because they are easy to generate, unique, non-...
49
votes
9answers
9k views

Is the UK Parliament e-petition system trustworthy?

Over the last few days, I've been hearing often about the petition to (pratically) "repeat" the Brexit referendum and I noticed that it is an online petition. I noticed that the "sign petition" form ...
49
votes
9answers
6k views

Why is HTTPS not the default protocol?

Why is HTTP still commonly used, instead what I would believe much more secure HTTPS?
47
votes
6answers
6k views

Should I be concerned if my website throws stack information?

I have a simple login form on my web page and the URL looks like this: example.com/signup/signup.php?q=1 If I try something like this: example.com/signup/signup.php?q=1&() I'm redirected to ...
46
votes
7answers
2k views

Why is application crash considered insecure?

If an application crashes, the program stops and there is nothing anyone can do about it, other than starting the program again. Crash is a bad behaviour in general and should be avoided, but why are ...
46
votes
9answers
7k views

I just discovered major security flaws in my web store?

A little background info here: I'm a self-taught web developer with very little experience outside of html/css, and the company I work for has hired a third party web development team to design us an ...
45
votes
2answers
8k views

Is this an attempted SQL injection?

Looking through error logs I found lots of requests to a web-app where the URL contains: /if(now()=sysdate(),sleep(10),0)/*'XOR(if(now()=sysdate(),sleep(10),0))OR'"XOR(if(now()=sysdate(),sleep(10),0))...
44
votes
6answers
10k views

How to Securely Implement a “Remember Me” Feature?

Assuming you already have a website that implements all of the standard login stuff, what is the correct and most secure way to allow users to automatically be logged in for a certain time period (let'...
43
votes
7answers
8k views

Is suggesting a correct url in a 404 page bad practice?

I'm currently writing a web application, and my client asked me if it would be possible to suggest a valid URL to the user when they accidentally write a typo in the URL bar, an example of this would ...
41
votes
15answers
8k views

Should we protect web application source code from being stolen by web hosts through obfuscation?

Is it worth to obfuscate a java web app source code so that the web host cannot make wrong use of the code or even steal your business? If so, how should this be dealt with? How should we obfuscate? ...
41
votes
5answers
5k views

What's the danger of having some random, out of my control, JavaScript code running on my pages?

My website pages reference some JavaScript code from a third-party CDN (analytics, etc). So I don't control what code is there - the third party may change those scripts at any moment and introduce ...
41
votes
6answers
18k views

https security - should password be hashed server-side or client-side?

I am building a web application which requires users to login. All communication goes through https. I am using bcrypt to hash passwords. I am facing a dilemma - I used to think it is safer to make a ...
39
votes
5answers
33k views

Are there security issues with embedding an HTTPS iframe on an HTTP page?

I've seen websites placing HTTPS iframes on HTTP pages. Are there any security concerns with this? Is it secure to transmit private information like credit card details in such a scheme (where the ...
39
votes
2answers
23k views

Minimum requrements for storing last 4 digits of credit card number?

We have a merchant website that uses Autorize.net's CIM and AIM. Our users may have multiple credit cards so we'd want to give them opportunity to distinguish between credit cards that they use on ...
39
votes
8answers
3k views

If I include a Forgot Password service, then what's the point of using a password?

I've implemented a Forgot Password service in the following way: User goes to login page, clicks on "Forgot password?" User is presented with a form that asks for their email address. Email is sent ...
38
votes
10answers
8k views

How can I securely check if a username exists?

I'm working on the onboarding functionality of my web app and at some point I'm asking a new user to choose a username. When the user gets to this point, I have his/her email and a cellphone number ...
38
votes
5answers
5k views

How do I safely inspect a potentially malicious website?

Sometimes I'm interested in what's behind a malicious website. How do I stay on the safe side if I decide to inspect? I'm searching for methods that are quicker and more simple than running the ...
36
votes
6answers
7k views

Is SQL injection possible with LIMIT?

A friend of mine built a web application that I'm testing for fun. I noticed that he allows a user to set the limit of a certain query, and that limit is not sanitized. For example, I can choose any ...
36
votes
10answers
12k views

Is anybody using client browser certificates?

Client browser certificates seem to be a nice way to protect sites from intruders - it is impossible to guess and should be harder to steal. Of course, they do not solve all the problems, but they add ...
34
votes
3answers
5k views

Do simple Linux servers really need a non-root user for security reasons?

Playing devil's advocate, Let's assume I purchase a Linux server from a hosting provider. I am given a password for the root user and am told I may login using SSH. The only purpose this server has ...
34
votes
2answers
12k views

Web Application encryption key management

In a nutshell, let's consider a web application which stores some information in a database as encrypted data. While I'm purposely trying to keep this some what generic, here are some assumptions: ...
33
votes
8answers
3k views

Dealing with excessive “Carding” attempts

We are currently setup using Magento on a LAMP stack for our e-commerce platform. As of a month or two ago we began noticing a lot of carding attempts against our website. All attempted transactions ...
33
votes
7answers
3k views

Is there a difference between GET and POST for web application security?

I have 2 choices in sending data between 2 web applications. I encode the data in Base64 and append to the URL and retrieve these parameters at my destination application and decode the parameters. ...
32
votes
3answers
2k views

Is there a security reason for a site to limit the number of times a user can change their password?

Is there a security reason to disallow a user to change their password as frequently as they want? I have found this security policy in a site and I am not sure why it is enforcing it. One reason I ...
32
votes
3answers
34k views

How to exploit HTTP Methods

Many security scanners like nikto, nessus, nmap, and w3af sometimes show that certain HTTP Methods like HEAD, GET, POST, PUT, DELETE, TRACE, OPTIONS, CONNECT, etc are vulnerable to attack. What do ...
32
votes
3answers
18k views

How should web app developers defend against JSON hijacking?

What is the best defense against JSON hijacking? Can anyone enumerate the standard defenses, and explain their strengths and weaknesses? Here are some defenses that I've seen suggested: If the ...
31
votes
5answers
6k views

Could mint.com be more secure, and if so, how?

After reading a bit about mint.com on the money stack exchange, I wanted to give it a try. But frankly, it scares me a little bit. The site has a bunch of links explaining how they're so secure. I ...
31
votes
2answers
4k views

How can a Software application defend against DoS or DDoS?

Most of the solutions for DoS attacks are not at the application level. In case I am using a proxy server, what are the possible countermeasures for DoS at the application level?