Tag Info

New answers tagged

1

Off the top of my head, I can think of four ways this strategy could fail. All can be mitigated to some degree through sound development practices and commonsense on the part of users, and a few would require some very targetted attacks, but they are risks nevertheless. Eval Storing confidential data on the heap will be risky if you intend to use eval, ...


0

You could use a JavaScript encryption library for the encryption/decryption process, and you could store the unencrypted data in sessionStorage in the browser. Is it secure? Only as secure as your app, the browser, the OS, and the machine it is running on. Storing the encryption key in the user's browser, let's say in localStorage, so that it persists ...


0

You've nailed it. It seems that the way to go is to NOT use the AngularJS method, and instead to break the model and to use the pure javascript redirect to refresh the site onto the Login page. This does seem to clear the network requests. Is this the recommended method? You're best assurance is to leave the page. After you've deleted the login cookie, ...


2

I think there is an additional problem/challenge with your scheme: Beside the problem of having the key pairs generated by the server, this scheme also allows for a man in the middle attack: A asks for the key of B, server answers with his own key C. Now the server can decrypt, read and encrypt again for B and send the new ciphertext to B. Neither A nor B ...



Top 50 recent answers are included