Tag Info

New answers tagged

1

You are asking two questions (I'm paraphrasing you...) Can I allow only my app to access my server? No, this is impossible. You cannot control the client. Root phone. Start debugger. Get your key. Create own app with your key. How do I secure my server? Use a security framework for your app server. If, for example, you are using Java Spring, ...


-1

Pass your username and password to the server from the APP over HTTPS and compare the hash of the password against the hash stored on the server against that username. Follow the 'usual' precautions: use a strong hash on the server (SHA256 for example) use a salt with the password (any truly random string will do) use a strong password (say at least 10 ...


-2

Use HTTPS - a decent certificate is like $10, so no excuses there :-) Don't invent your own authentication/authorization mechanisms. Use what smarter people have developed, tested, assessed and tested again. A good starting point is to evaluate OAuth.


3

There are a number of reasons this is a bad idea. First and foremost being that bash, fundamentally, is written to facilitate users doing whatever they want to do. It was written to make it easy to do anything you'd want to do a vast number of different ways, and as a result it's possible to do most things a vast number of different ways. It was not written ...


6

I think your question is a bit too broad. Session hijacking can be done on different levels, and it's not just copying something between browsers. For example: A malicious network admin / proxy admin could intercept your session ID and re-use this also. A vulnerable website could be exploited using cross site scripting, where an attacker can gain ...


0

Sort of. You can create a landing page that lists all client IP addresses using WebRTC and load another address. You can use gethostbyaddr() on every IP returned, and you will get some user198.domain-a.company.xxx. Just set a session variable, and you are set.


0

Not really. You can directly retrieve some agent information and the local IP/hostname but not their workgroup/domain status. That being said - you could get the hostname and query Active Directory via WMI to see if it is a domain computer, but you can never prove the validity of the hostname. Another option is that you can authenticate a user against ...


-1

It's possible to get corresponding to a given IP address using gethostbyaddr function http://php.net/manual/en/function.gethostbyaddr.php: $proxy = (isset($_SERVER['HTTP_X_FORWARDED_FOR'])) ? $_SERVER['HTTP_X_FORWARDED_FOR'] : false; if(!!$proxy){ $ipaddress = $_SERVER['HTTP_X_FORWARDED_FOR']; echo "Warning: Your cliend is using proxy, may could ...



Top 50 recent answers are included