Questions tagged [client-side]

Client-side refers to operations that are performed by the client in a client–server relationship in a computer network.

Filter by
Sorted by
Tagged with
0
votes
0answers
10 views

TLS 1.3 handshake Failure - Client reports "Header Too Long" [migrated]

I'm in process of updating the client to support TLS 1.3. When trying to connect to TLS 1.3 server, client is reporting "Internal error". Wireshark traces showing that server responded with ...
0
votes
0answers
19 views

Is there hardware (like u2f-keys) for passwordless client-side encryption & decryption [duplicate]

I know that u2f keys are designed as authentication factors, but I think it would not be far fetched to also add a protocol that the user can use to encrypt or decrypt data on the client-side. This ...
0
votes
1answer
69 views

Upload Private Key into Web App

I am developing a web application that is integrating with a third-party that does not have OAuth capability, but instead use a variety of account IDs and keys to generate tokens for API calls. On the ...
0
votes
0answers
53 views

A way to provide a TLS certificate that is not self-signed or using AWS private certificate authority

I need to secure the communications between my frontend and backend. My frontend resides in a PHP server owned by DonDominio (web hosting) and my backend in an instance in AWS. My public web domain is ...
0
votes
0answers
35 views

DOM-based XSS example doesn't work

Google have written up a great explanation of XSS attacks with 3 interactive demos: https://www.google.co.uk/about/appsecurity/learning/xss/ If I follow the instructions, I can see a JavaScript alert ...
0
votes
1answer
49 views

Protect server-side key with client token

I'd like to encrypt some data on the server using a user-managed secret. I could just ask for a password and derive a key from that, but ideally I'd like to offer users the option of using a yubikey ...
0
votes
1answer
93 views

Does copying cookies allow attackers to view pages that should be visible only after login?

TLDR; Copying the request from ChromeDevTools along with all cookies allows me to view pages that I should not be able to view after logging in. Have I been pwned ? I just found a terrifyingly easy ...
0
votes
1answer
96 views

How to securely store users API keys submitted through client

I am developing a web application which will require users to provide 3rd party API keys through the client, which will then be used to make requests to the 3rd party API from the backend of my app. ...
1
vote
0answers
56 views

OAuth for command line application

I'm planning to add an "official" command line tool for developers to interact with our API. The tool is basically just a glorified curl client, interacting with the API via HTTPS ...
0
votes
1answer
60 views

Can display a GIF in <img> tag causing Client-side DOS

SVG image can be used in DOS user browser with billion laugh attack. Can we do the same with other image types? especially GIF? Thanks everyone.
0
votes
1answer
32 views

Why would you use random algorithm for CSFLE if you can't query the inserted data?

I think I really misunderstand something about data encryption. This guide (https://docs.mongodb.com/manual/core/security-client-side-encryption/#randomized-encryption) says the following: "...
1
vote
1answer
97 views

Is android pentesting partially similar to web pentesting? [closed]

I'm already into web pentesting. I'm willing to learn android pentesting now. From what I understand, the server side part like API etc is similar to web pentesting and I need to learn about client ...
0
votes
0answers
32 views

What is the nature of vulnerabilities in JS modules used client-side?

When installing JavaScript modules, I sometimes see that some of them have security vulnerabilities. It made me wonder about the kind of vulnerabilities this could be, and how they could be exploited ...
2
votes
1answer
99 views

I discovered a Client Side Template Injection (CSTI), and after?

As part of a bounty bug, I discovered a Client Side Template Injection (CSTI). I would like to create more "impressive" payload to increase the risk of the vulnerability. The framework ...
1
vote
1answer
103 views

Does streaming a game from a dedicated gaming VM still expose my PCs to significant privacy/security concerns from installed games?

So the plan is to make a Windows 10 guest, give it lots of vCPUs and memory, perform GPU passthrough to achieve maximal performance, and then load my games onto this guest. The aim of this would be to ...
1
vote
1answer
74 views

Is there any 100% transparent way to set up client side TLS certs from a web browser?

Edit #2: It seems the answer to Q#1 is "No" (which suggests I would need to look for some other solution, which is something I can do on my own, please don't spend time making suggestions ...
0
votes
0answers
53 views

How to deal with new clients in a hybrid encrypted database?

I'm working on a private project and I'm not really sure about hybrid encryption. I am not a security expert but just a student. Background: I'm working on a project that uses couchDB as a database in ...
0
votes
1answer
216 views

Get a key values mismatch when export cert and key from PKCS#12

I have a PKCS #12 file and want to export certificates and private key from the PKCS #12 file with openssl. openssl pkcs12 -in test.p12 -nocerts -out key.pem openssl pkcs12 -in test.p12 -out certs.pem ...
2
votes
0answers
45 views

Does the SSL/TLS lifetime change affect client certificates?

From 2020.09.01 Google, Apple an Mozilla changed the maximum trust time to 398 days. I'm working on a project, where the client also authenticates itself with a certificate. This certificate is stored ...
0
votes
1answer
106 views

How to select a random node when nodes are untrusted in a distributed network?

Assume in a distributed network, where the nodes are not trusted and are identified by their public keys, we intend to select one of them in a random process. In such a situation, all of the nodes ...
0
votes
0answers
94 views

Client-side encryption of data, but the server can also add data without reading stored data

For a new application I'd like to store messages for each user's account on a centralized server. The user accesses the application through a SPA javascript web app through their browser. These ...
0
votes
1answer
100 views

Pattern for access controlled client side encryption

How would you design a server/client system where a client is granted a key to encrypt/decrypt data, but the key could be revoked/redistributed by the server? Data encrypted prior must still be ...
0
votes
1answer
144 views

Is using Argon2 with a public random on client side a good idea to protect passwords in transit?

Not sure if things belongs in Crypto SE or here but anyway: I'm building an app and I'm trying to decide whatever is secure to protect user passwords in transit, in addition to TLS we already have. In ...
0
votes
2answers
26 views

Sending arbitrary request despite form constraints

I have a flask web application which is configured with HSTS (no man in middle) and it has a login form. Inputs to the login form have necessary constraints and HTML disallows incorrect formats. My ...
0
votes
0answers
65 views

Does hashing client-side increase attack surface (assuming TLS and serverside salt+hash)? [duplicate]

This question asks whether one should hash on the client or the server. I want to know if there is any reason, aside from having to maybe handle one extra hashing library (if it's not already in your ...
2
votes
1answer
98 views

Can a client application volunteer to send a certificate?

When testing our c# application with a service from a new supplier our request was denied because the client certificate was not send. Network traffic with a service where our application is known to ...
0
votes
1answer
95 views

Where is the best way to filter user input? [duplicate]

Users can interfere with any piece of data transmitted between the client and the server, including request parameters, cookies, and HTTP headers. Where is the best way to filter user input, on the ...
4
votes
1answer
238 views

How to validate client side safety in a Zero Knowlegde model

What is sometimes called Zero Knowledge, sometimes end to end encryption occurs when a server only processes ciphered data (at least for sensitive data) with a result where a compromise of this server ...
0
votes
0answers
55 views

Can we know which client side script is performing a particular action on a website?

Recently in an website I had noticed that the data which is received from the server is not the data that is being displayed.I think it would have been modified on client-side. So, Is there any way by ...
-2
votes
2answers
167 views

SSL Cert for client side web application, is it needed?

For client-side web applications that run in your machine (that you download at first visit - Blazor WebAssembly to be specific): Do I need to enable SSL (HTTPS) for this application or web server ...
2
votes
3answers
265 views

How to secure a price passed to a payment gateway on client?

Using Javascript, say a customer buy a product that cost 10$. Many payment gateways, like PayPal and Stripe, offer a client side Form where you input the sale data (price, amount, buyer address, etc), ...
2
votes
1answer
189 views

Offloading TLS client-cert checking to OpenSSL (or similar) if server does not support it

TL;DR I want to have "some thing" to handle client-certs on behalf a server that is unable to do it, for secure user authentication in addition to regular TLS encryption. Context In this question ...
2
votes
1answer
1k views

Encryption and decryption in the browser on the client's side – is it safe?

There is a possibility to download the file with one’s PII from the dedicated web server. The file might be decrypted by filling the two factors. These two factors are delivered via email and SMS. The ...
2
votes
2answers
168 views

OWASP Client-Side Testing - How To

In the OWASP Testing Guide, it has a whole section called "Client-Side Testing." This section has to do with testing for things such as DOM-based XSS, JavaScript execution, HTML injection, Client-Side ...
1
vote
1answer
622 views

What are the sources of “SEC_ERROR_REUSED_ISSUER_AND_SERIAL” errors when using self-signed x509 Certificates in PKCS#12 files?

As part of an internal Client/Server application, I have created my own (self-signed) Certificate Authority (CA), as well as both Client and Server certificates signed by my CA. Loading my CA ...
0
votes
2answers
127 views

jwt symmetric signature security risks (from client side)

I am currently implementing an iOS app, which integrates with a cloud hosted .net backend system in azure, which. The api login endpoint takes user/pass -> replies with an signed only HS256 jwt token....
3
votes
1answer
272 views

What security concerns are there for a fully client-side JS/HTML5 app?

I'm working on an Interactive Fiction story in Undum, which is a fully client-side JS/HTML5 framework. I've been reading about Content Security Policy lately (after looking up what a crypto nonce is) ...
1
vote
2answers
183 views

Preventing XSS by filtering data from the server to the client

Before you immediately comment "you can't trust the client!", please read the whole question. I've been reading about how to prevent XSS attacks lately, and everything I've found says that the server ...
1
vote
1answer
52 views

In client side certificate authentication why, if, do we need to share the certificate

Certificate authentication on https has always been one of my huge knowledge gaps ,and was trying to fill it today. I have made some progress on the client side certificate authentication but however ...
2
votes
1answer
77 views

Offline HTML JS App

I designed a small webapp (I would rather call it browserApp) that helps me to automate a task. Now, I don't need a webserver to host this app as it is merely using js, jquery and other js libraries ...
1
vote
1answer
80 views

Is there a security benefit to testing HTTP header presence with Javascript?

I have found in one of the client side libraries that it is performing an AJAX call to an API and checking if response contains all of the following headers with corresponding values (as a security ...
5
votes
2answers
7k views

How to store user credentials in browser securely?

I need help to authenticate users with user credentials. We are using Angular 5 as a front-end & need to store the user's email and password if the user checks on Remember Me. Then autofill user ...
2
votes
3answers
3k views

Can Burp be setup to intercept traffic from client application?

I have a client application installed on my Windows computer and I want to perform a MITM on this application to inspect the traffic. I understand that Burp can do the MITM for web application, but ...
1
vote
1answer
148 views

Is there any security concern if I kept password hash on client side?

I have a mobile application that needs to be able to work when the phone is offline. In order to prevent misuse by others when they have a short physical access to the phone the requirement is to ...
0
votes
0answers
150 views

A strategy to allow select split-tunneling for printing

A topic has come up with some colleagues that appears to be a 'regular' and I thought to ask the forum: We have had use-cases for remote workers who VPN to the corporate network, which does not ...
23
votes
12answers
14k views

Is there a way to hide HTML source code yet keeping it effective?

I have a website with a client-side HTML contact form created manually (not as output of an HTML constructor like PHP): <form action="mailto:someone@example.com"> Email Adress:<br> ...
1
vote
1answer
62 views

Using local files securely on website

I have a website on which users can select a file from their local machine, manipulate it and then save it. The website is written entirely in JavaScript to ensure it's purely client-side. Is the ...
0
votes
1answer
80 views

Can certificate pinning be achieved strictly at the network layer?

With a client side java application that interacts with the server over http, is it possible to handle certificate pinning strictly at the network layer? Meaning, if the certificate is pinned on a ...
1
vote
1answer
208 views

Access client certificate stored on another computer

We are developing an application, that is using client certificate needed for client authentication (HTTPS connection) when using a specific web service. When a customer company has hundreds of ...
1
vote
1answer
524 views

Java Applet AccessControlException

I am doing a security course and a module on client side attacks, which is why this post might seem evil or outdated. I have a Java applet fetching a malicious jar file and trying to then download ...

1
2 3 4 5 6