Tag Info

Hot answers tagged

9

How can I defend against malicious GET requests? These requests do not look really malicious. At least based on your description they don't cause any harm, i.e. no unwanted code execution, SQL injection or similar attacks. They only need some resources to process. What you see is what every operator of a web server can see in the log files: lots of ...


5

In conjunction with what @SakamakiIzayoi suggested: Fail2ban scans log files (e.g. /var/log/apache/error_log) and bans IPs that show the malicious signs -- too many password failures, seeking for exploits, etc. Generally Fail2Ban is then used to update firewall rules to reject the IP addresses for a specified amount of time, although any ...


4

The easiest defense solution would be to install a Web Application Firewall. You can find in-depth descriptions regarding them on OWASP and Wikipedia. I doubt the requests would slow down your site. Attackers would most likely request existing items as it would be far more effective in wasting your web-server's resources.


1

This sounds different from what I've heard about previously. My understanding of a typical microservice architecture is that you'd have a variety of fine-grained microservices, composited together into one or more coarse-grained applications. In that view, you would probably have a single E-Commerce Web App, which utilizes a variety of microservices in the ...


1

The DB URL (other than username and password) and Pepper aren't sensitive values. You may not want to advertise them, but you should assume they are known anyway. If your security is dependent on them being secure, then you are almost certainly not PCI compliant. Any "security" that that secrecy provides is just security by obscurity. The DB should be ...


1

Look up the OWASP Top 10 (which is the most relevant resource for your question) proposed by edvinas.me and the list of Web-oriented attacks covered by fel1x. I don't have good advice for Web server security because I haven't done it in ages, but make sure you keep your servers up to date and that they run with only the privileges they need (separate OS ...



Only top voted, non community-wiki answers of a minimum length are eligible