Hot answers tagged

10

How can I defend against malicious GET requests? These requests do not look really malicious. At least based on your description they don't cause any harm, i.e. no unwanted code execution, SQL injection or similar attacks. They only need some resources to process. What you see is what every operator of a web server can see in the log files: lots of ...


6

Making inputs safe is better done as late as possible. That is, when data is output to the page. Globally "sanitizing" input data is bad because it is impossible to distinguish between good data and bad data at this stage (as you say, if you're allowing HTML to be entered by your users, the framework can't tell the difference between HTML that's meant to be ...


3

The easiest defense solution would be to install a Web Application Firewall. You can find in-depth descriptions regarding them on OWASP and Wikipedia. I doubt the requests would slow down your site. Attackers would most likely request existing items as it would be far more effective in wasting your web-server's resources.


2

This is often brought up everywhere, partially because everyone keeps repeating the mantra that input sanitation is the answer. It isn't. It's dangerous, bug-prone, and it needs to go away. Of course, you should always check to see if your input lengths are correctly corresponding to their appropriate columns. Sanitizing Input vs. Sanitizing Output. ...


2

On the fundamental front, it is never secure to store or transmit anything somebody wouldn't want people to get. You can make things safer by using various security/encryption methods, but it is still fundamentally unsafe. On the practical front, addresses are so easy to get as it is. You should avoid correlating them to more personal information which is ...


1

Yes, there's no problem with using the same CSRF token since it is already sharing the same auth token. As long as the token is regenerated per new session and both the API and the APP check that the CSRF token is associated with that particular session then this should mitigate CSRF.


1

This sounds different from what I've heard about previously. My understanding of a typical microservice architecture is that you'd have a variety of fine-grained microservices, composited together into one or more coarse-grained applications. In that view, you would probably have a single E-Commerce Web App, which utilizes a variety of microservices in the ...



Only top voted, non community-wiki answers of a minimum length are eligible