Hot answers tagged web-browser
4
Most of the OWASP top 10 still applies to web services. A more detailed resource would be the Mozilla WebAppSec Guide.
"RESTful" web services should not have a "session token". Related: "Do sessions really violate RESTfulness?" However at the end of the day you need a some kind of token for authentication purposes.
In short, if you are writing a ...
4
What precaustions should be taken when the file displayed by a webpage is specified by the GET value
You should be sure to put additional filtering on it to make sure it doesn't try things like that. Personally, at a minimum, I would attempt to parse and reform the input and make sure that no operations like directory changes can occur.
A better option would be to store the filenames in a DB and pass in a simple token that could be used to look up the ...
3
As I understand it, an untrusted Java applet run in the browser is going to be sandboxed, so I don't believe it will have any more access to your system if you download it and run it in your browser locally than if you run it from the originating server, or from your browser cache, at least by design.
However, you should be concerned about Java applets, ...
3
I'm willing to bet that they don't actually identify the computer, they just send you a persistent cookie once you've successfully logged in, and as long as your browser returns that cookie, they know it's a previously used machine.
You should be able to test this quite easily using something like Firefox's Web Developer toolbar which will let you both ...
3
There is a good reason for preventing concurrent connections - if they are not needed by your users.
A good rule of thumb is to not allow more functionality than that which is needed. If your users are never going to connect more than one simultaneous session, disallowing it would reduce the risk of attack (as an attacker would not be able to conduct their ...
3
It works on Chrome too, but so far (Version 26.0.1410.64 m) only with the temporary X-Content-Security-Policy instead of Content-Security-Policy header, as defined in the already updated code samples. W3C Web Application Security working group just moved the Content Security Policy 1.1 from previous working group draft to a W3C Editor's Draft status today, ...
3
If this will be with end user consent, then the easiest would be to write a simple service per each operating system that your clients will use, pack them as convenient installation executables, and host on your web server.
For example on Windows systems, all that service/application would have to do is to start at system boot, listen on some preset port ...
3
I think what your looking for is something like these HP iLO and Dell Drac
This way you can not only power off, but you can reboot/turn on/etc computers from a web console (also serial and other protocols).
These are generally speaking, safe. Vulnerabilities crop up from time to time but nothing major recently as far as i'm aware. The obvious risks, if ...
2
If you are truly clearing all the local records when you close the browser, are not logged in to any accounts and are connecting through a VPN, then it is possible they are using information your browser itself reveals about you to guess at who you are. Certain information can be provided by a browser to the server.
Things like available font lists and ...
1
What precaustions should be taken when the file displayed by a webpage is specified by the GET value
To answer you question, it all depends on how your site treats the input parameter. If, like mentioned, it is possible to change the directory using the input, then yes.
GET params just end up as strings when it gets to the php; You are not sending it special commands like you would in a command line interface (unless it is coded that way in the php).
1
I think all the answers given so far are all valid. However I'm not sure I agree completely. Take this site for example. I can have multiple 'sessions' open and logged in on stackexchange.com, does that make security.stackexchange.com less secure? I think that the merits of that are debatable, and there are pro's and cons to the argument. Although I would ...
1
I don't think allowing multiple user to connect is vulnerable to attack. If Gmail allows this, I'm sure they thought about the potentials risks ;)
Now, that doesn't mean your application isn't vulnerable, but it will be more based on how you developped the login process (https, database hashed password, etc).
Since you mention that you have secured your ...
1
Make it require a password when the screensaver comes on. Make the screensaver come on after 5 minutes. I've also used a small utility (BtProx) which uses bluetooth to determine if you're close. When you walk away with your phone it locks the computer. You can also use something like LemonScan which uses your webcam to determine if you're using your computer ...
1
Isn't this true and ironic? We place so much emphasis on browser security and OS security -- and rightly so -- yet if I step away for a minute while my browser is open, ...
As I previously implied on another post quoting this comic, the problem is that fundamentally, if you leave your screen unlocked the OS has no way to tell that the person typing and ...
1
Well, the best solution here would be to lock the laptop before you go via a screensaver interface or small utilities (like 'slock'). This way, even if the laptop gets stolen, the villain will have to reboot it and face the same problem with logging in. Of course this is not a problem to get the root (in case it's linux) but then the user data (like dropbox ...
Only top voted, non community-wiki answers of a minimum length are eligible
