Tag Info

New answers tagged

1

Anything sent in a request using the HTTP TRACE method will be echo-ed back in the response. This may lead to Cross Site Tracing (XST) attacks, which could lead to steal a user's cookie even if the cookie has the HTTPOnly attribute flag set. The HTTP TRACE method is used for debugging purposes only and should be disabled. Apache Configuration: ...


1

However, the webservice for creating the account has no restrictions, meaning an attacker could spam GET requests to it from any device to create any number of users they want and flood the database/server. My question is, how can this be avoided? You can use a mix of CAPTCHA and IP restrictions to avoid such type of attack. IP restrictions: ...


-1

However, it's not login-based in the traditional sense that users don't sign up with an email or anything. We just automatically create an account for them with some randomly generated UUID as their "login" to the service. If you are just allowing ANY user to create an account with your application, without providing any personal information, it ...


2

both methods in the questions deal with 'with plaintext passwords', which is a very bad idea. Yet , for illustrative purposes is can help to clarify things. Comparison logic in application: $result = sql_query('SELECT users.password FROM users WHERE userId = %i', $userId); if ($result['password'] == $userPassword) { print 'access granted'; } else { ...


1

Think about it this way: Most system have multiple components. In a traditional set up this is usually a client that is distributed to the users, a server, and a database. The database is usually a commonly used, highly optimized piece of software written by somebody else, whereas servers are very often custom software that is written by you specifically ...


1

Application The application supplies the credentials via the application code logic to the server as a payload of the application's data flow. Database The connection directly connects to the database and issues database commands in order to confirm the credentials.



Top 50 recent answers are included