Questions tagged [client-side]

Client-side refers to operations that are performed by the client in a client–server relationship in a computer network.

Filter by
Sorted by
Tagged with
2
votes
1answer
53 views

I discovered a Client Side Template Injection (CSTI), and after?

As part of a bounty bug, I discovered a Client Side Template Injection (CSTI). I would like to create more "impressive" payload to increase the risk of the vulnerability. The framework ...
1
vote
1answer
63 views

Does streaming a game from a dedicated gaming VM still expose my PCs to significant privacy/security concerns from installed games?

So the plan is to make a Windows 10 guest, give it lots of vCPUs and memory, perform GPU passthrough to achieve maximal performance, and then load my games onto this guest. The aim of this would be to ...
1
vote
1answer
70 views

Is there any 100% transparent way to set up client side TLS certs from a web browser?

Edit #2: It seems the answer to Q#1 is "No" (which suggests I would need to look for some other solution, which is something I can do on my own, please don't spend time making suggestions ...
0
votes
0answers
47 views

How to deal with new clients in a hybrid encrypted database?

I'm working on a private project and I'm not really sure about hybrid encryption. I am not a security expert but just a student. Background: I'm working on a project that uses couchDB as a database in ...
0
votes
1answer
78 views

Get a key values mismatch when export cert and key from PKCS#12

I have a PKCS #12 file and want to export certificates and private key from the PKCS #12 file with openssl. openssl pkcs12 -in test.p12 -nocerts -out key.pem openssl pkcs12 -in test.p12 -out certs.pem ...
2
votes
0answers
38 views

Does the SSL/TLS lifetime change affect client certificates?

From 2020.09.01 Google, Apple an Mozilla changed the maximum trust time to 398 days. I'm working on a project, where the client also authenticates itself with a certificate. This certificate is stored ...
0
votes
1answer
95 views

How to select a random node when nodes are untrusted in a distributed network?

Assume in a distributed network, where the nodes are not trusted and are identified by their public keys, we intend to select one of them in a random process. In such a situation, all of the nodes ...
0
votes
0answers
71 views

Client-side encryption of data, but the server can also add data without reading stored data

For a new application I'd like to store messages for each user's account on a centralized server. The user accesses the application through a SPA javascript web app through their browser. These ...
0
votes
0answers
38 views

Handling API keys for client-side app with cloud key vault

I would like to hear about the security implications of my desktop app's current API usage workflow: Client-side WPF desktop app connects to Azure Key Vault, a cloud vault, by authenticating via a ...
0
votes
1answer
76 views

Pattern for access controlled client side encryption

How would you design a server/client system where a client is granted a key to encrypt/decrypt data, but the key could be revoked/redistributed by the server? Data encrypted prior must still be ...
0
votes
1answer
101 views

Is using Argon2 with a public random on client side a good idea to protect passwords in transit?

Not sure if things belongs in Crypto SE or here but anyway: I'm building an app and I'm trying to decide whatever is secure to protect user passwords in transit, in addition to TLS we already have. In ...
0
votes
2answers
24 views

Sending arbitrary request despite form constraints

I have a flask web application which is configured with HSTS (no man in middle) and it has a login form. Inputs to the login form have necessary constraints and HTML disallows incorrect formats. My ...
0
votes
0answers
60 views

Does hashing client-side increase attack surface (assuming TLS and serverside salt+hash)? [duplicate]

This question asks whether one should hash on the client or the server. I want to know if there is any reason, aside from having to maybe handle one extra hashing library (if it's not already in your ...
2
votes
1answer
76 views

Can a client application volunteer to send a certificate?

When testing our c# application with a service from a new supplier our request was denied because the client certificate was not send. Network traffic with a service where our application is known to ...
0
votes
1answer
67 views

Where is the best way to filter user input? [duplicate]

Users can interfere with any piece of data transmitted between the client and the server, including request parameters, cookies, and HTTP headers. Where is the best way to filter user input, on the ...
3
votes
1answer
229 views

How to validate client side safety in a Zero Knowlegde model

What is sometimes called Zero Knowledge, sometimes end to end encryption occurs when a server only processes ciphered data (at least for sensitive data) with a result where a compromise of this server ...
0
votes
0answers
54 views

Can we know which client side script is performing a particular action on a website?

Recently in an website I had noticed that the data which is received from the server is not the data that is being displayed.I think it would have been modified on client-side. So, Is there any way by ...
-2
votes
2answers
103 views

SSL Cert for client side web application, is it needed?

For client-side web applications that run in your machine (that you download at first visit - Blazor WebAssembly to be specific): Do I need to enable SSL (HTTPS) for this application or web server ...
2
votes
3answers
114 views

How to secure a price passed to a payment gateway on client?

Using Javascript, say a customer buy a product that cost 10$. Many payment gateways, like PayPal and Stripe, offer a client side Form where you input the sale data (price, amount, buyer address, etc), ...
2
votes
1answer
184 views

Offloading TLS client-cert checking to OpenSSL (or similar) if server does not support it

TL;DR I want to have "some thing" to handle client-certs on behalf a server that is unable to do it, for secure user authentication in addition to regular TLS encryption. Context In this question ...
2
votes
1answer
510 views

Encryption and decryption in the browser on the client's side – is it safe?

There is a possibility to download the file with one’s PII from the dedicated web server. The file might be decrypted by filling the two factors. These two factors are delivered via email and SMS. The ...
2
votes
2answers
138 views

OWASP Client-Side Testing - How To

In the OWASP Testing Guide, it has a whole section called "Client-Side Testing." This section has to do with testing for things such as DOM-based XSS, JavaScript execution, HTML injection, Client-Side ...
1
vote
1answer
395 views

What are the sources of “SEC_ERROR_REUSED_ISSUER_AND_SERIAL” errors when using self-signed x509 Certificates in PKCS#12 files?

As part of an internal Client/Server application, I have created my own (self-signed) Certificate Authority (CA), as well as both Client and Server certificates signed by my CA. Loading my CA ...
0
votes
2answers
105 views

jwt symmetric signature security risks (from client side)

I am currently implementing an iOS app, which integrates with a cloud hosted .net backend system in azure, which. The api login endpoint takes user/pass -> replies with an signed only HS256 jwt token....
3
votes
1answer
226 views

What security concerns are there for a fully client-side JS/HTML5 app?

I'm working on an Interactive Fiction story in Undum, which is a fully client-side JS/HTML5 framework. I've been reading about Content Security Policy lately (after looking up what a crypto nonce is) ...
1
vote
2answers
126 views

Preventing XSS by filtering data from the server to the client

Before you immediately comment "you can't trust the client!", please read the whole question. I've been reading about how to prevent XSS attacks lately, and everything I've found says that the server ...
1
vote
1answer
48 views

In client side certificate authentication why, if, do we need to share the certificate

Certificate authentication on https has always been one of my huge knowledge gaps ,and was trying to fill it today. I have made some progress on the client side certificate authentication but however ...
2
votes
1answer
70 views

Offline HTML JS App

I designed a small webapp (I would rather call it browserApp) that helps me to automate a task. Now, I don't need a webserver to host this app as it is merely using js, jquery and other js libraries ...
1
vote
1answer
78 views

Is there a security benefit to testing HTTP header presence with Javascript?

I have found in one of the client side libraries that it is performing an AJAX call to an API and checking if response contains all of the following headers with corresponding values (as a security ...
3
votes
1answer
4k views

How to store user credentials in browser securely?

I need help to authenticate User with user credentials. We are using Angular 5 as a front-end & need to store user's email and password if user checks on remember Me. autofill user credentials ...
1
vote
3answers
2k views

Can Burp be setup to intercept traffic from client application?

I have a client application installed on my Windows computer and I want to perform a MITM on this application to inspect the traffic. I understand that Burp can do the MITM for web application, but ...
1
vote
1answer
139 views

Is there any security concern if I kept password hash on client side?

I have a mobile application that needs to be able to work when the phone is offline. In order to prevent misuse by others when they have a short physical access to the phone the requirement is to ...
0
votes
0answers
106 views

A strategy to allow select split-tunneling for printing

A topic has come up with some colleagues that appears to be a 'regular' and I thought to ask the forum: We have had use-cases for remote workers who VPN to the corporate network, which does not ...
23
votes
12answers
13k views

Is there a way to hide HTML source code yet keeping it effective?

I have a website with a client-side HTML contact form created manually (not as output of an HTML constructor like PHP): <form action="mailto:someone@example.com"> Email Adress:<br> ...
1
vote
1answer
58 views

Using local files securely on website

I have a website on which users can select a file from their local machine, manipulate it and then save it. The website is written entirely in JavaScript to ensure it's purely client-side. Is the ...
0
votes
1answer
77 views

Can certificate pinning be achieved strictly at the network layer?

With a client side java application that interacts with the server over http, is it possible to handle certificate pinning strictly at the network layer? Meaning, if the certificate is pinned on a ...
1
vote
1answer
170 views

Access client certificate stored on another computer

We are developing an application, that is using client certificate needed for client authentication (HTTPS connection) when using a specific web service. When a customer company has hundreds of ...
1
vote
1answer
396 views

Java Applet AccessControlException

I am doing a security course and a module on client side attacks, which is why this post might seem evil or outdated. I have a Java applet fetching a malicious jar file and trying to then download ...
3
votes
1answer
182 views

Can a javascript on parent page log keystrokes inside an iframe?

I am trying to analyze the possibility of accessing keystrokes from an iframe using a javascript running on the parent page. The potential attack which I am looking to verify is Cross Frame Scripting. ...
22
votes
8answers
6k views

How can I re-use my password and still protect the password if it is exposed from one source?

I know that all servers should at least store my credentials as hash(password + salt) + salt, with a secure and well known hash function and a salt unique for me, generated from a secure and well ...
0
votes
2answers
148 views

Can I rely on the CSRF cookie to check if a user is authenticated on the client-side?

I have a website that runs on example.com. The website makes AJAX calls to my backend API which sits at api.example.com. I employ a double-submit verification strategy. The backend has protected ...
3
votes
2answers
2k views

What are client-side exploits

I am learning about cybersecurity and have read about client-side exploits. I know they are vulnerabilities/exploits and they target the client instead of a server. What are some examples of this and ...
0
votes
2answers
192 views

How client-side OAuth is secure?

I want to make a static webpage, but secure it with a login. In order to do this, I looked at this link. Basically, I want users to log in their Google account to be able to view the webpage. But I ...
-3
votes
2answers
177 views

Is pure client-side security better or worse (from a security point of view) than pure server-side security in client-server software?

I'd like to know in general which of the two types of security is the best in all aspects that may refer to security (we can use this the general aspects for security: integrity, availability, ...
7
votes
2answers
2k views

Why not store password in cookie?

I've got a novice question - It is often said that you should not store plaintext passwords in a client-side cookie. (I'm imagining a web browser cookie, but I supposed this applies in general.) But ...
0
votes
1answer
43 views

How do JavaScript (and mobile) APIs keep user data clean?

Let's say we're running Google Analytics, and we're tracking user specific data (or displaying contents based on that data, such as most recently viewed pages) -- we add a pixel, and then we pass the ...
0
votes
1answer
94 views

what is the best algorithm for hashing stored users info on client-side on a web app

I have this scenario in a web app which I'm working on its client-side code(I'm building it with ReactJS): I obtain user's info hash 'em send it to the server for being authenticated and when I get ...
1
vote
1answer
189 views

Metasploit: java_signed_applet attack hangs after user response

I am trying to perform a client side attack with Metasploit on a 32 bit Windows 7 Professional N (SP1) victim. I have Windows Defender and Firewall disabled and Java Control Panel Security set at ...
2
votes
2answers
182 views

What is client side non-DOM XSS?

I've been reading on the new categories of XSS. According to OWASP, they're no longer just reflected, stored and DOM-based XSS, but rather server/client side, and then subdivided into reflected/stored....
1
vote
0answers
126 views

Client Side Encryption - The Last Mile

Is there any best practice on how to handle "the last mile" in a cloud stored, client side encrypted scenario for a web application? (Sensitive data has to be encrypted before being sent and stored on ...

1
2 3 4 5