Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [client-side]

Client-side refers to operations that are performed by the client in a client–server relationship in a computer network.

28 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
4 votes
0 answers
2k views

How exactly does "Apache Shiro's" hashing work when using a Desktop-Client

I was looking at this question How does storing hash passwords work? and every answer essentially says that Hashing is done via the server, or most of it should, as that is the safest way to do it. I ...
XaolingBao's user avatar
3 votes
0 answers
551 views

OAuth for command line application

I'm planning to add an "official" command line tool for developers to interact with our API. The tool is basically just a glorified curl client, interacting with the API via HTTPS ...
Moritz Friedrich's user avatar
3 votes
0 answers
595 views

How to remember the trusted machine in an application

We need to remember trusted devices in our application. I have done some R&D for this and found out that Facebook achieves this using cookies. But, if I see Google, they don't use cookies, I guess....
user3040851's user avatar
2 votes
0 answers
101 views

Security in Angular: Addressing XSS Concerns with External Libraries and Interpolation

Introduction: We heavily use external libraries, such as DataTables, in combination with interpolation. In Angular, we've identified two primary XSS prevention strategies: Interpolation ({{ }}) ...
VJSpeter's user avatar
2 votes
0 answers
130 views

Does the SSL/TLS lifetime change affect client certificates?

From 2020.09.01 Google, Apple an Mozilla changed the maximum trust time to 398 days. I'm working on a project, where the client also authenticates itself with a certificate. This certificate is stored ...
zsomborv's user avatar
2 votes
0 answers
244 views

How to securely manage generating files on the client-side to download

While searching for a way to convert an HTML table to .CSV file, I found there are 2 ways to generate files to download on the client side with JavaScript: using data URLs by generating the file on ...
AccountantM's user avatar
2 votes
0 answers
181 views

Key Management and Authentication in Note Taking App with Client-Side Encryption

I've been working for some time on a pet project of mine: a note-taking application similar to Evernote with the difference that all content is client-side encrypted. I would like to get some feedback ...
Oliver Weichhold's user avatar
2 votes
0 answers
378 views

Safe to Encrypt ClientId (Integer value) to use as Client Key?

Asked a follow up question (see this link). Based on my understanding, I have to issue an unique ClientId and Client Secret Key to the API subscribers right after the registration phase (client lives ...
Coder Absolute's user avatar
1 vote
0 answers
102 views

Best practice of x.509 client certificates accross multiple systems

I have several MongoDB's where I use x.509 Certificates to Authenticate Clients Let's say I create certificate and user for admin: subject: CN=admin issuer: CN=MongoDB Issuing CA -> db.createUser({...
Wernfried Domscheit's user avatar
1 vote
1 answer
216 views

How to prevent shopping cart alterations in another tab when paymentintent is already created?

Has anyone figured out a solution to this? I seem to have gotten to the same conclusion with no solution. If I were to go the my app's checkout page, the payintent is created in the backend (explained ...
Furqan_25's user avatar
1 vote
1 answer
1k views

Java Applet AccessControlException

I am doing a security course and a module on client side attacks, which is why this post might seem evil or outdated. I have a Java applet fetching a malicious jar file and trying to then download ...
3therk1ll's user avatar
  • 147
1 vote
1 answer
357 views

Metasploit: java_signed_applet attack hangs after user response

I am trying to perform a client side attack with Metasploit on a 32 bit Windows 7 Professional N (SP1) victim. I have Windows Defender and Firewall disabled and Java Control Panel Security set at ...
Nemesis's user avatar
  • 29
1 vote
0 answers
224 views

Client Side Encryption - The Last Mile

Is there any best practice on how to handle "the last mile" in a cloud stored, client side encrypted scenario for a web application? (Sensitive data has to be encrypted before being sent and stored on ...
TommyF's user avatar
  • 111
1 vote
0 answers
641 views

Client authentication using certificates in M2M communication

We're planning to implement following scenario for a secure machine-to-machine (M2M) communication network. We have some gateways and a lot of secure sensors which should only be able to "speak" to ...
TrinityTonic's user avatar
1 vote
0 answers
521 views

How to make CNG certificates available for mutual authentication in browser?

I have implemented a CNG key storage provider and propagate my certificate according to the answer to this question to the MY store. I can see my certificate there using the MMC console. However, when ...
Frank's user avatar
  • 155
1 vote
0 answers
149 views

Mutual auth client certs for a pool of requesting servers behind a proxy

I've got a situation that is puzzling me. We have a vendor that is requiring mutual authentication when making a request to them. They are requesting we give them a client cert identifying our ...
Matt Foerschler's user avatar
1 vote
0 answers
337 views

How Secure Would Client Side Sha-512 Be In JavaScript

I've created an Capture The Flag challenge for me and a few of my mates, and for the final challenge, you're goal is to log in as admin to a site. Now the site doesn't use any server side languages (...
The Gamer King's user avatar
1 vote
0 answers
151 views

Possible vulnerabilities in private chat application implemented using web broadcasting

I have never used web-sockets but I am working in a PHP framework which has builtin broadcasting facility. This broadcasting use web-sockets technologies named Redis and Pusher. The workflow of this ...
Hassan Saqib's user avatar
1 vote
1 answer
230 views

Client Side Encryption algorithm: security + is padding algorithm needed in this case?

I will be using CSE for a web application as follows. Generate a random AES key Encrypt the cleartext data with this AES key Encrypt the AES key with the service's public key, using RSA Obviously, ...
christophetd's user avatar
0 votes
0 answers
260 views

client side certificate installed on ios 16 are not being sent by browsers on that device when a server requests for a identity cert

I have a client side certificate from cloudflare (non-root) that i install on our devices in order to gain access to our sites that ask for a client side certificate from browsers. This works ...
Muhammad Ebrahym's user avatar
0 votes
0 answers
296 views

How to turn a relative path script (js) import to an absolue one with a url for XSS ? (more details below)

I have a parameter whose value is injected in the HTML as the following <script src="/dir1/dir2/dir3/dir4/INJECT_HERE"> </script> I was able to traverse back to just / but when ...
study man's user avatar
0 votes
0 answers
114 views

Can you trust VPN clients on Windows?

I want to use a commercial VPN. It's more reliable when using their own client, since it can automatically select and switch servers etc. But what about the security? On my Android phone, the apps are ...
cuckoo's user avatar
  • 371
0 votes
0 answers
225 views

A way to provide a TLS certificate that is not self-signed or using AWS private certificate authority

I need to secure the communications between my frontend and backend. My frontend resides in a PHP server owned by DonDominio (web hosting) and my backend in an instance in AWS. My public web domain is ...
Alejandro Cortizo's user avatar
0 votes
0 answers
301 views

Client-side encryption of data, but the server can also add data without reading stored data

For a new application I'd like to store messages for each user's account on a centralized server. The user accesses the application through a SPA javascript web app through their browser. These ...
fli's user avatar
  • 1
0 votes
0 answers
123 views

Can we know which client side script is performing a particular action on a website?

Recently in an website I had noticed that the data which is received from the server is not the data that is being displayed.I think it would have been modified on client-side. So, Is there any way by ...
Dante's user avatar
  • 1
0 votes
0 answers
435 views

A strategy to allow select split-tunneling for printing

A topic has come up with some colleagues that appears to be a 'regular' and I thought to ask the forum: We have had use-cases for remote workers who VPN to the corporate network, which does not ...
Sean E. M.'s user avatar
0 votes
0 answers
112 views

Security of password to database in 2-layer SW model

I'm struggling with kinda old application which is written for Windows and has a 2-layer approach, meaning that the client SW is connecting to backend database directly. This of course mean that the ...
user1563721's user avatar
  • 1,119
0 votes
0 answers
114 views

Deny/Identify compromised machine sending information to a server?

i was wondering - consider i have 2 machines - client and server. the Client is opened to the internet, and sends very sensitive data to the server. If fake data will be sent to the server and is ...
ArielB's user avatar
  • 189