meta user
network profile
| bio | website | shivampatel.net |
|---|---|---|
| location | New York, United States | |
| age | ||
| visits | member for | 1 year, 4 months |
| seen | Apr 4 at 22:01 | |
| stats | profile views | 25 |
I code! Do you?
|
Jan 6 |
awarded | Yearling |
|
Oct 17 |
comment |
Is it safe to store twitter access tokens client side? did you mean access_token_key and access_token_secret ? |
|
Oct 8 |
revised |
How to disable caching of form data? corrected block diagram and added cache-control header info |
|
Oct 8 |
comment |
How to disable caching of form data? +1 Glad this question was asked. Reposting login creds on page refresh just renders the entire authentication system broken. |
|
Oct 8 |
revised |
How to disable caching of form data? corrected block diagram |
|
Oct 8 |
answered | How to disable caching of form data? |
|
Sep 14 |
comment |
anonymization for scanning and hacking @D.W. Thanks for rewording. I realize that the original verbiage was indeed suggesting that I am asking him to do it that way. Cheers!! |
|
Sep 14 |
comment |
anonymization for scanning and hacking I just answered the question from a technical perspective. I am just assuming and hoping that someone is not naive enough do these kinds of disruptive things. Forget Tor, the idea of scanning/exploiting some resource without prior permission and consent from the owner is in itself a very bad idea and should be totally discouraged. So I totally agree with @D.W. |
|
Sep 14 |
answered | anonymization for scanning and hacking |
|
Sep 13 |
answered | XSS : Blacklist characters vs. whitelist |
|
Sep 11 |
revised |
Facebook API : App Secret - possible misuse added one way of securing the key based on D.W.'s comment |
|
Sep 11 |
comment |
Facebook API : App Secret - possible misuse @D.W. Yes, that is correct. In such a case the server is proxying on behalf of the client for the OAuth steps. This then becomes similar to the browser(client) - server - facebook model. I am editing my answer to include that. |
|
Sep 10 |
revised |
Protecting against CSRF when a form is being submitted via an AJAX call Corrected a line which isn't applicable to this scenario. |
|
Sep 10 |
comment |
Protecting against CSRF when a form is being submitted via an AJAX call Yeah, you are right. I misinterpreted the question. My bad. Gaurav, in case you are not able to send cookies in AJAX requests, one way out could be to have the token appended in the querystring of the URL, eg: example.com/createuser.php?token=<token>; The script createuser.php will then compare the $_GET['token'] and $_POST['token_hidden_form_field'] and proceed if they match. In this scheme, if a attacker manages to POST a form, he'd still need to know the correct querystring parameter 'token'. |
|
Sep 10 |
answered | Protecting against CSRF when a form is being submitted via an AJAX call |
|
Sep 10 |
answered | Where can I get security breach alerts? |
|
Sep 10 |
revised |
Facebook API : App Secret - possible misuse edited verbiage to make things more clear (hopefully ;) ) |
|
Sep 10 |
answered | Facebook API : App Secret - possible misuse |
|
Aug 15 |
awarded | Caucus |
|
Jul 17 |
revised |
How to prevent private data being disclosed outside of Organization fixed the misleading verbiage |
