Questions tagged [client-side]

Client-side refers to operations that are performed by the client in a client–server relationship in a computer network.

Filter by
Sorted by
Tagged with
0 votes
0 answers
20 views

How to turn a relative path script (js) import to an absolue one with a url for XSS ? (more details below)

I have a parameter whose value is injected in the HTML as the following <script src="/dir1/dir2/dir3/dir4/INJECT_HERE"> </script> I was able to traverse back to just / but when ...
user avatar
0 votes
0 answers
24 views

How to prevent shopping cart alterations in another tab when paymentintent is already created?

Has anyone figured out a solution to this? I seem to have gotten to the same conclusion with no solution. If I were to go the my app's checkout page, the payintent is created in the backend (explained ...
user avatar
0 votes
2 answers
57 views

How to secure an enpoint to prevent programatic calls from the client?

We have a game that is built on the client side. People who get past a certain level are eligible to enter a raffle. This is done by sending a request to an endpoint from the client once they get past ...
user avatar
  • 1
0 votes
0 answers
45 views

Can you trust VPN clients on Windows?

I want to use a commercial VPN. It's more reliable when using their own client, since it can automatically select and switch servers etc. But what about the security? On my Android phone, the apps are ...
user avatar
  • 371
1 vote
1 answer
49 views

How are session keys transferred between a client and a server?

Session keys are generated during TLS handshake and are transferred from clients to server through asymmetric encryption FOR ONCE. However, I have heard that session keys are single-use, which mean a ...
user avatar
0 votes
1 answer
62 views

How to send JWT Access token with requests without being sniffed?

I'm trying to create a mobile app which helps to connect with my mobile app. While going through authentication I used JWT. While authenticating it, it returns access token and refresh token to the ...
user avatar
0 votes
2 answers
83 views

When using a user password for client side encryption, do I have to store the salt for the user encryption key on the server?

The password of the user shall be used for client side encryption. A PBKDF and salt shall be used to derive a key from the user password. Do I need to store this salt on the server and deliver it to ...
user avatar
  • 697
0 votes
1 answer
100 views

Passing password back from server to client? [duplicate]

I've never seen any example of this and I'm just curious why? Why is it not okay just to pass it through HTTPs + encoded in a JWT? I will not be storing the password anywhere on the client side, I ...
user avatar
  • 1
0 votes
0 answers
67 views

What is the risk of a known ReDOS Vulnerability in a client side (Browser) app

I'm trying to determine if a client side app, that runs in the browser has any real danger from being vulnerable to a known ReDOS issue. My understanding of ReDOS is that inefficiencies or known short ...
user avatar
  • 223
0 votes
0 answers
96 views

window.history.pushState as a solution to document.referer

the problem: Having URL parameters in a web page URL address to add functionality to a website (authenticate/authorize showing stuff in the UI, being used in further http requests on load, etc.) can ...
user avatar
0 votes
0 answers
18 views

Authenticating/ identifying dynamic UI Client to Back-End [duplicate]

The title may be a bit misleading so I will try to make this as clear as possible. We have several microservices that expose endpoints and they communicate to each other. They needed to authenticate ...
user avatar
  • 101
0 votes
0 answers
19 views

Is there hardware (like u2f-keys) for passwordless client-side encryption & decryption [duplicate]

I know that u2f keys are designed as authentication factors, but I think it would not be far fetched to also add a protocol that the user can use to encrypt or decrypt data on the client-side. This ...
user avatar
  • 697
0 votes
1 answer
213 views

Upload Private Key into Web App

I am developing a web application that is integrating with a third-party that does not have OAuth capability, but instead use a variety of account IDs and keys to generate tokens for API calls. On the ...
user avatar
  • 103
0 votes
0 answers
119 views

A way to provide a TLS certificate that is not self-signed or using AWS private certificate authority

I need to secure the communications between my frontend and backend. My frontend resides in a PHP server owned by DonDominio (web hosting) and my backend in an instance in AWS. My public web domain is ...
user avatar
0 votes
1 answer
88 views

Protect server-side key with client token

I'd like to encrypt some data on the server using a user-managed secret. I could just ask for a password and derive a key from that, but ideally I'd like to offer users the option of using a yubikey ...
user avatar
  • 123
0 votes
1 answer
324 views

Does copying cookies allow attackers to view pages that should be visible only after login?

TLDR; Copying the request from ChromeDevTools along with all cookies allows me to view pages that I should not be able to view after logging in. Have I been pwned ? I just found a terrifyingly easy ...
user avatar
  • 265
0 votes
1 answer
228 views

How to securely store users API keys submitted through client

I am developing a web application which will require users to provide 3rd party API keys through the client, which will then be used to make requests to the 3rd party API from the backend of my app. ...
user avatar
1 vote
0 answers
147 views

OAuth for command line application

I'm planning to add an "official" command line tool for developers to interact with our API. The tool is basically just a glorified curl client, interacting with the API via HTTPS ...
user avatar
0 votes
1 answer
111 views

Can display a GIF in <img> tag causing Client-side DOS

SVG image can be used in DOS user browser with billion laugh attack. Can we do the same with other image types? especially GIF? Thanks everyone.
user avatar
0 votes
1 answer
76 views

Why would you use random algorithm for CSFLE if you can't query the inserted data?

I think I really misunderstand something about data encryption. This guide (https://docs.mongodb.com/manual/core/security-client-side-encryption/#randomized-encryption) says the following: "...
user avatar
  • 3
1 vote
1 answer
139 views

Is android pentesting partially similar to web pentesting? [closed]

I'm already into web pentesting. I'm willing to learn android pentesting now. From what I understand, the server side part like API etc is similar to web pentesting and I need to learn about client ...
user avatar
  • 11
2 votes
1 answer
156 views

I discovered a Client Side Template Injection (CSTI), and after?

As part of a bounty bug, I discovered a Client Side Template Injection (CSTI). I would like to create more "impressive" payload to increase the risk of the vulnerability. The framework ...
user avatar
  • 274
1 vote
1 answer
200 views

Does streaming a game from a dedicated gaming VM still expose my PCs to significant privacy/security concerns from installed games?

So the plan is to make a Windows 10 guest, give it lots of vCPUs and memory, perform GPU passthrough to achieve maximal performance, and then load my games onto this guest. The aim of this would be to ...
user avatar
1 vote
1 answer
122 views

Is there any 100% transparent way to set up client side TLS certs from a web browser?

Edit #2: It seems the answer to Q#1 is "No" (which suggests I would need to look for some other solution, which is something I can do on my own, please don't spend time making suggestions ...
user avatar
  • 111
0 votes
1 answer
451 views

Get a key values mismatch when export cert and key from PKCS#12

I have a PKCS #12 file and want to export certificates and private key from the PKCS #12 file with openssl. openssl pkcs12 -in test.p12 -nocerts -out key.pem openssl pkcs12 -in test.p12 -out certs.pem ...
user avatar
  • 103
2 votes
0 answers
80 views

Does the SSL/TLS lifetime change affect client certificates?

From 2020.09.01 Google, Apple an Mozilla changed the maximum trust time to 398 days. I'm working on a project, where the client also authenticates itself with a certificate. This certificate is stored ...
user avatar
0 votes
0 answers
156 views

Client-side encryption of data, but the server can also add data without reading stored data

For a new application I'd like to store messages for each user's account on a centralized server. The user accesses the application through a SPA javascript web app through their browser. These ...
user avatar
  • 1
0 votes
1 answer
155 views

Pattern for access controlled client side encryption

How would you design a server/client system where a client is granted a key to encrypt/decrypt data, but the key could be revoked/redistributed by the server? Data encrypted prior must still be ...
user avatar
  • 3
0 votes
1 answer
223 views

Is using Argon2 with a public random on client side a good idea to protect passwords in transit?

Not sure if things belongs in Crypto SE or here but anyway: I'm building an app and I'm trying to decide whatever is secure to protect user passwords in transit, in addition to TLS we already have. In ...
user avatar
0 votes
2 answers
66 views

Sending arbitrary request despite form constraints

I have a flask web application which is configured with HSTS (no man in middle) and it has a login form. Inputs to the login form have necessary constraints and HTML disallows incorrect formats. My ...
user avatar
0 votes
0 answers
102 views

Does hashing client-side increase attack surface (assuming TLS and serverside salt+hash)? [duplicate]

This question asks whether one should hash on the client or the server. I want to know if there is any reason, aside from having to maybe handle one extra hashing library (if it's not already in your ...
user avatar
2 votes
1 answer
160 views

Can a client application volunteer to send a certificate?

When testing our c# application with a service from a new supplier our request was denied because the client certificate was not send. Network traffic with a service where our application is known to ...
user avatar
  • 123
0 votes
1 answer
161 views

Where is the best way to filter user input? [duplicate]

Users can interfere with any piece of data transmitted between the client and the server, including request parameters, cookies, and HTTP headers. Where is the best way to filter user input, on the ...
user avatar
4 votes
1 answer
299 views

How to validate client side safety in a Zero Knowlegde model

What is sometimes called Zero Knowledge, sometimes end to end encryption occurs when a server only processes ciphered data (at least for sensitive data) with a result where a compromise of this server ...
user avatar
  • 1,316
0 votes
0 answers
89 views

Can we know which client side script is performing a particular action on a website?

Recently in an website I had noticed that the data which is received from the server is not the data that is being displayed.I think it would have been modified on client-side. So, Is there any way by ...
user avatar
  • 1
-2 votes
2 answers
287 views

SSL Cert for client side web application, is it needed?

For client-side web applications that run in your machine (that you download at first visit - Blazor WebAssembly to be specific): Do I need to enable SSL (HTTPS) for this application or web server ...
user avatar
  • 97
2 votes
3 answers
444 views

How to secure a price passed to a payment gateway on client?

Using Javascript, say a customer buy a product that cost 10$. Many payment gateways, like PayPal and Stripe, offer a client side Form where you input the sale data (price, amount, buyer address, etc), ...
user avatar
2 votes
1 answer
229 views

Offloading TLS client-cert checking to OpenSSL (or similar) if server does not support it

TL;DR I want to have "some thing" to handle client-certs on behalf a server that is unable to do it, for secure user authentication in addition to regular TLS encryption. Context In this question ...
user avatar
2 votes
1 answer
2k views

Encryption and decryption in the browser on the client's side – is it safe?

There is a possibility to download the file with one’s PII from the dedicated web server. The file might be decrypted by filling the two factors. These two factors are delivered via email and SMS. The ...
user avatar
1 vote
2 answers
237 views

OWASP Client-Side Testing - How To

In the OWASP Testing Guide, it has a whole section called "Client-Side Testing." This section has to do with testing for things such as DOM-based XSS, JavaScript execution, HTML injection, Client-Side ...
user avatar
  • 113
1 vote
1 answer
741 views

What are the sources of “SEC_ERROR_REUSED_ISSUER_AND_SERIAL” errors when using self-signed x509 Certificates in PKCS#12 files?

As part of an internal Client/Server application, I have created my own (self-signed) Certificate Authority (CA), as well as both Client and Server certificates signed by my CA. Loading my CA ...
user avatar
0 votes
2 answers
189 views

jwt symmetric signature security risks (from client side)

I am currently implementing an iOS app, which integrates with a cloud hosted .net backend system in azure, which. The api login endpoint takes user/pass -> replies with an signed only HS256 jwt token....
user avatar
3 votes
1 answer
331 views

What security concerns are there for a fully client-side JS/HTML5 app?

I'm working on an Interactive Fiction story in Undum, which is a fully client-side JS/HTML5 framework. I've been reading about Content Security Policy lately (after looking up what a crypto nonce is) ...
user avatar
  • 133
1 vote
2 answers
286 views

Preventing XSS by filtering data from the server to the client

Before you immediately comment "you can't trust the client!", please read the whole question. I've been reading about how to prevent XSS attacks lately, and everything I've found says that the server ...
user avatar
1 vote
1 answer
93 views

In client side certificate authentication why, if, do we need to share the certificate

Certificate authentication on https has always been one of my huge knowledge gaps ,and was trying to fill it today. I have made some progress on the client side certificate authentication but however ...
user avatar
  • 113
2 votes
1 answer
120 views

Offline HTML JS App

I designed a small webapp (I would rather call it browserApp) that helps me to automate a task. Now, I don't need a webserver to host this app as it is merely using js, jquery and other js libraries ...
user avatar
1 vote
1 answer
121 views

Is there a security benefit to testing HTTP header presence with Javascript?

I have found in one of the client side libraries that it is performing an AJAX call to an API and checking if response contains all of the following headers with corresponding values (as a security ...
user avatar
5 votes
2 answers
9k views

How to store user credentials in browser securely?

I need help to authenticate users with user credentials. We are using Angular 5 as a front-end & need to store the user's email and password if the user checks on Remember Me. Then autofill user ...
user avatar
  • 153
3 votes
3 answers
5k views

Can Burp be setup to intercept traffic from client application?

I have a client application installed on my Windows computer and I want to perform a MITM on this application to inspect the traffic. I understand that Burp can do the MITM for web application, but ...
user avatar
  • 131
1 vote
1 answer
205 views

Is there any security concern if I kept password hash on client side?

I have a mobile application that needs to be able to work when the phone is offline. In order to prevent misuse by others when they have a short physical access to the phone the requirement is to ...
user avatar
  • 113

1
2 3 4 5 6