Tag Info

New answers tagged

0

There are a couple of potential risks here, depending on how exactly this is setup and what the requirements are. If end users can obtain direct access to layer red and can obtain valid credentials, they then have unfettered access to layer red using only those credentials, skipping the auth check on layer blue completely. If layer blue only exists as ...


3

You are proposing doing it backwards. It doesn't do you any good to hold a private key on the server and hand out a public certificate to be used to validate the client. Instead, you want the client to make a key pair and submit the certificate to the server to be stored. The server can then use the certificate to generate a challenge for the client to ...


0

No - there is nothing inherently insecure about having a POCO that exposes a collection model objects. Depending on how you use user input to interact with any object and depending on what you do with that data later can open you up to potential security vulnerabilities, but without seeing your code it's impossible to say if this is something you should be ...


1

I'm no expert but I believe to suppliment what user2316037 stated I believe javax.xml.crypto.dsig which allows you to sign and validate an XML digital signature.I believe that is what you are looking to use. Retrieved from: http://www.oracle.com/technetwork/java/javamail/dig-signature-api-140772.html



Top 50 recent answers are included