Tag Info

Hot answers tagged

10

How can I defend against malicious GET requests? These requests do not look really malicious. At least based on your description they don't cause any harm, i.e. no unwanted code execution, SQL injection or similar attacks. They only need some resources to process. What you see is what every operator of a web server can see in the log files: lots of ...


5

In conjunction with what @SakamakiIzayoi suggested: Fail2ban scans log files (e.g. /var/log/apache/error_log) and bans IPs that show the malicious signs -- too many password failures, seeking for exploits, etc. Generally Fail2Ban is then used to update firewall rules to reject the IP addresses for a specified amount of time, although any ...


4

The easiest defense solution would be to install a Web Application Firewall. You can find in-depth descriptions regarding them on OWASP and Wikipedia. I doubt the requests would slow down your site. Attackers would most likely request existing items as it would be far more effective in wasting your web-server's resources.


1

Yes, there's no problem with using the same CSRF token since it is already sharing the same auth token. As long as the token is regenerated per new session and both the API and the APP check that the CSRF token is associated with that particular session then this should mitigate CSRF.


1

This sounds different from what I've heard about previously. My understanding of a typical microservice architecture is that you'd have a variety of fine-grained microservices, composited together into one or more coarse-grained applications. In that view, you would probably have a single E-Commerce Web App, which utilizes a variety of microservices in the ...


1

The DB URL (other than username and password) and Pepper aren't sensitive values. You may not want to advertise them, but you should assume they are known anyway. If your security is dependent on them being secure, then you are almost certainly not PCI compliant. Any "security" that that secrecy provides is just security by obscurity. The DB should be ...



Only top voted, non community-wiki answers of a minimum length are eligible