Questions tagged [client-side]

Client-side refers to operations that are performed by the client in a client–server relationship in a computer network.

Filter by
Sorted by
Tagged with
0
votes
0answers
46 views

Does hashing client-side increase attack surface (assuming TLS and serverside salt+hash)? [duplicate]

This question asks whether one should hash on the client or the server. I want to know if there is any reason, aside from having to maybe handle one extra hashing library (if it's not already in your ...
1
vote
1answer
64 views

Can a client application volunteer to send a certificate?

When testing our c# application with a service from a new supplier our request was denied because the client certificate was not send. Network traffic with a service where our application is known to ...
0
votes
1answer
48 views

Where is the best way to filter user input?

Users can interfere with any piece of data transmitted between the client and the server, including request parameters, cookies, and HTTP headers. Where is the best way to filter user input, on the ...
3
votes
1answer
190 views

How to validate client side safety in a Zero Knowlegde model

What is sometimes called Zero Knowledge, sometimes end to end encryption occurs when a server only processes ciphered data (at least for sensitive data) with a result where a compromise of this server ...
0
votes
0answers
52 views

Can we know which client side script is performing a particular action on a website?

Recently in an website I had noticed that the data which is received from the server is not the data that is being displayed.I think it would have been modified on client-side. So, Is there any way by ...
-2
votes
2answers
90 views

SSL Cert for client side web application, is it needed?

For client-side web applications that run in your machine (that you download at first visit - Blazor WebAssembly to be specific): Do I need to enable SSL (HTTPS) for this application or web server ...
2
votes
3answers
81 views

How to secure a price passed to a payment gateway on client?

Using Javascript, say a customer buy a product that cost 10$. Many payment gateways, like PayPal and Stripe, offer a client side Form where you input the sale data (price, amount, buyer address, etc), ...
2
votes
1answer
180 views

Offloading TLS client-cert checking to OpenSSL (or similar) if server does not support it

TL;DR I want to have "some thing" to handle client-certs on behalf a server that is unable to do it, for secure user authentication in addition to regular TLS encryption. Context In this question ...
1
vote
1answer
109 views

Encryption and decryption in the browser on the client's side – is it safe?

There is a possibility to download the file with one’s PII from the dedicated web server. The file might be decrypted by filling the two factors. These two factors are delivered via email and SMS. The ...
1
vote
1answer
68 views

OWASP Client-Side Testing - How To

In the OWASP Testing Guide, it has a whole section called "Client-Side Testing." This section has to do with testing for things such as DOM-based XSS, JavaScript execution, HTML injection, Client-Side ...
1
vote
1answer
142 views

What are the sources of “SEC_ERROR_REUSED_ISSUER_AND_SERIAL” errors when using self-signed x509 Certificates in PKCS#12 files?

As part of an internal Client/Server application, I have created my own (self-signed) Certificate Authority (CA), as well as both Client and Server certificates signed by my CA. Loading my CA ...
0
votes
0answers
24 views

Requirements for client based anti-fraud solutions in online banking

There is a range of anti-fraud products available that a bank can use to detect potential threats on client side in their online banking portal or app. Example features would be device fingerprinting ...
0
votes
1answer
71 views

jwt symmetric signature security risks (from client side)

I am currently implementing an iOS app, which integrates with a cloud hosted .net backend system in azure, which. The api login endpoint takes user/pass -> replies with an signed only HS256 jwt token....
3
votes
1answer
148 views

What security concerns are there for a fully client-side JS/HTML5 app?

I'm working on an Interactive Fiction story in Undum, which is a fully client-side JS/HTML5 framework. I've been reading about Content Security Policy lately (after looking up what a crypto nonce is) ...
1
vote
2answers
99 views

Preventing XSS by filtering data from the server to the client

Before you immediately comment "you can't trust the client!", please read the whole question. I've been reading about how to prevent XSS attacks lately, and everything I've found says that the server ...
1
vote
1answer
45 views

In client side certificate authentication why, if, do we need to share the certificate

Certificate authentication on https has always been one of my huge knowledge gaps ,and was trying to fill it today. I have made some progress on the client side certificate authentication but however ...
2
votes
1answer
64 views

Offline HTML JS App

I designed a small webapp (I would rather call it browserApp) that helps me to automate a task. Now, I don't need a webserver to host this app as it is merely using js, jquery and other js libraries ...
1
vote
1answer
74 views

Is there a security benefit to testing HTTP header presence with Javascript?

I have found in one of the client side libraries that it is performing an AJAX call to an API and checking if response contains all of the following headers with corresponding values (as a security ...
2
votes
1answer
2k views

How to store user credentials in browser securely?

I need help to authenticate User with user credentials. We are using Angular 5 as a front-end & need to store user's email and password if user checks on remember Me. autofill user credentials ...
1
vote
3answers
865 views

Can Burp be setup to intercept traffic from client application?

I have a client application installed on my Windows computer and I want to perform a MITM on this application to inspect the traffic. I understand that Burp can do the MITM for web application, but ...
1
vote
1answer
133 views

Is there any security concern if I kept password hash on client side?

I have a mobile application that needs to be able to work when the phone is offline. In order to prevent misuse by others when they have a short physical access to the phone the requirement is to ...
0
votes
0answers
62 views

A strategy to allow select split-tunneling for printing

A topic has come up with some colleagues that appears to be a 'regular' and I thought to ask the forum: We have had use-cases for remote workers who VPN to the corporate network, which does not ...
23
votes
12answers
13k views

Is there a way to hide HTML source code yet keeping it effective?

I have a website with a client-side HTML contact form created manually (not as output of an HTML constructor like PHP): <form action="mailto:someone@example.com"> Email Adress:<br> ...
1
vote
1answer
54 views

Using local files securely on website

I have a website on which users can select a file from their local machine, manipulate it and then save it. The website is written entirely in JavaScript to ensure it's purely client-side. Is the ...
0
votes
1answer
71 views

Can certificate pinning be achieved strictly at the network layer?

With a client side java application that interacts with the server over http, is it possible to handle certificate pinning strictly at the network layer? Meaning, if the certificate is pinned on a ...
1
vote
1answer
142 views

Access client certificate stored on another computer

We are developing an application, that is using client certificate needed for client authentication (HTTPS connection) when using a specific web service. When a customer company has hundreds of ...
1
vote
1answer
275 views

Java Applet AccessControlException

I am doing a security course and a module on client side attacks, which is why this post might seem evil or outdated. I have a Java applet fetching a malicious jar file and trying to then download ...
3
votes
1answer
136 views

Can a javascript on parent page log keystrokes inside an iframe?

I am trying to analyze the possibility of accessing keystrokes from an iframe using a javascript running on the parent page. The potential attack which I am looking to verify is Cross Frame Scripting. ...
22
votes
8answers
6k views

How can I re-use my password and still protect the password if it is exposed from one source?

I know that all servers should at least store my credentials as hash(password + salt) + salt, with a secure and well known hash function and a salt unique for me, generated from a secure and well ...
0
votes
2answers
101 views

Can I rely on the CSRF cookie to check if a user is authenticated on the client-side?

I have a website that runs on example.com. The website makes AJAX calls to my backend API which sits at api.example.com. I employ a double-submit verification strategy. The backend has protected ...
3
votes
2answers
1k views

What are client-side exploits

I am learning about cybersecurity and have read about client-side exploits. I know they are vulnerabilities/exploits and they target the client instead of a server. What are some examples of this and ...
0
votes
2answers
157 views

How client-side OAuth is secure?

I want to make a static webpage, but secure it with a login. In order to do this, I looked at this link. Basically, I want users to log in their Google account to be able to view the webpage. But I ...
-3
votes
2answers
152 views

Is pure client-side security better or worse (from a security point of view) than pure server-side security in client-server software?

I'd like to know in general which of the two types of security is the best in all aspects that may refer to security (we can use this the general aspects for security: integrity, availability, ...
6
votes
2answers
1k views

Why not store password in cookie?

I've got a novice question - It is often said that you should not store plaintext passwords in a client-side cookie. (I'm imagining a web browser cookie, but I supposed this applies in general.) But ...
0
votes
1answer
43 views

How do JavaScript (and mobile) APIs keep user data clean?

Let's say we're running Google Analytics, and we're tracking user specific data (or displaying contents based on that data, such as most recently viewed pages) -- we add a pixel, and then we pass the ...
0
votes
1answer
86 views

what is the best algorithm for hashing stored users info on client-side on a web app

I have this scenario in a web app which I'm working on its client-side code(I'm building it with ReactJS): I obtain user's info hash 'em send it to the server for being authenticated and when I get ...
1
vote
1answer
157 views

Metasploit: java_signed_applet attack hangs after user response

I am trying to perform a client side attack with Metasploit on a 32 bit Windows 7 Professional N (SP1) victim. I have Windows Defender and Firewall disabled and Java Control Panel Security set at ...
2
votes
2answers
163 views

What is client side non-DOM XSS?

I've been reading on the new categories of XSS. According to OWASP, they're no longer just reflected, stored and DOM-based XSS, but rather server/client side, and then subdivided into reflected/stored....
1
vote
0answers
120 views

Client Side Encryption - The Last Mile

Is there any best practice on how to handle "the last mile" in a cloud stored, client side encrypted scenario for a web application? (Sensitive data has to be encrypted before being sent and stored on ...
1
vote
0answers
238 views

Client authentication using certificates in M2M communication

We're planning to implement following scenario for a secure machine-to-machine (M2M) communication network. We have some gateways and a lot of secure sensors which should only be able to "speak" to ...
0
votes
2answers
185 views

Security-wise, is an in-browser JavaScript implementation fundamentally different from a server-side language (e.g. Python) implementation?

As I understand it, JavaScript implementations running in browsers need to run untrusted code and operate on untrusted data in a secure manner. Language (e.g. Python) implementations running on a ...
2
votes
1answer
85 views

Secure Ids in Browser [closed]

We frequently need to send entity ids to the client side. How could we protect this data (especially ids)? Even if we encrypt using same key every time, it can be identified by analysis. For ...
1
vote
1answer
144 views

limit client certificate to domain name

If i want to use client certificates for authentication to a certain part of my website, is it possible to make the client certificate only work on a certain domain name? I know when requesting the ...
1
vote
1answer
2k views

Session ID in the very First Client Hello

Is it normal to have Session ID in the first Client Hello, and then the server picks it up and accepts the same Session ID and uses it in all further TLS traffic. That is the "Client or Browser" tells ...
0
votes
0answers
34 views

Security of password to database in 2-layer SW model

I'm struggling with kinda old application which is written for Windows and has a 2-layer approach, meaning that the client SW is connecting to backend database directly. This of course mean that the ...
1
vote
0answers
333 views

How to make CNG certificates available for mutual authentication in browser?

I have implemented a CNG key storage provider and propagate my certificate according to the answer to this question to the MY store. I can see my certificate there using the MMC console. However, when ...
2
votes
1answer
71 views

What advantages would client-side certificates have over signature based auth such as Oauth2 or HMAC for HTTP Requests?

My application currently supports these two authentications methods OAuth2 and HMAC Auth. OAuth2 https://tools.ietf.org/html/rfc6749 HMAC https://tools.ietf.org/html/draft-cavage-http-signatures-09 ...
1
vote
2answers
357 views

What is the best practice for encrypting and storing temp data on client?

I have a client-server system, where the client is an Android app. The client and the server communicate over HTTP. If the server/network is not available, then the client has to store the data ...
0
votes
1answer
517 views

Does client side hashing add any benefit here?

My situation is this: User credentials are stored on the server, bcrypt, random hashes. I'm designing a REST API, so I'd like to keep this as stateless as possible! The client is an Android/iPhone ...
4
votes
2answers
2k views

What exactly is client-side encryption?

I've done a bit of research on client-side encryption, I've looked on Wikipedia and various other sources, I was just curious, however, if you had a network administrator watching over all traffic, ...

1
2 3 4 5