New answers tagged

0

I've seen several web applications that implement a "sudo mode". In your example, it might look something like this: I, an admin, am logged into your application, and stay logged in for long periods of time (perhaps the session expires after 30 days). I protect this account with reasonable amount of security, but I'm not super paranoid about it. When I ...


3

I'll propose a rule of thumb which may help you with your decision: When switching from a lower privilege level to higher, make them login again. When switching from higher to lower, do not require another login. Here's an example of how bank ATMs implement this rule. Consider these 2 scenarios: You put in your ATM card, enter your pin, select ...


0

You open yourself up to bad user behavior at that point. Really you want to keep them safe by making sure you protect against as much bad user behavior as possible. If an admin opens the web view it makes it easier for them to forget they are in the admin area and leave without signing out of the admin area, leaving it open to someone sitting down and ...


0

Generating another public-private key would be overkill for this senario. If you're really worried about some malware reading the browser cache, you can instruct the browser to just not cache anything. <meta http-equiv=”Cache-Control” content=”no-cache” /> <meta http-equiv=”Cache-Control” content=”no-store” /> If you're worried about someone ...


2

What you are proposing sounds reasonably secure. The one change I would make is to move from UUIDs to a simple 128-bit cryptographically secure random number. I suggest this because, while UUIDs are intended to be unique, they are not designed to be unpredictable. Depending on the UUID implementation details, perhaps an attacker can start to predict ...



Top 50 recent answers are included