Questions tagged [client-side]
Client-side refers to operations that are performed by the client in a client–server relationship in a computer network.
29
questions with no upvoted or accepted answers
4
votes
0
answers
2k
views
How exactly does "Apache Shiro's" hashing work when using a Desktop-Client
I was looking at this question
How does storing hash passwords work?
and every answer essentially says that Hashing is done via the server, or most of it should, as that is the safest way to do it. I ...
- 897
3
votes
0
answers
414
views
How to remember the trusted machine in an application
We need to remember trusted devices in our application. I have done some R&D for this and found out that Facebook achieves this using cookies. But, if I see Google, they don't use cookies, I guess....
- 31
2
votes
3
answers
619
views
How to securely store users API keys submitted through client
I am developing a web application which will require users to provide 3rd party API keys through the client, which will then be used to make requests to the 3rd party API from the backend of my app.
...
- 21
2
votes
0
answers
356
views
OAuth for command line application
I'm planning to add an "official" command line tool for developers to interact with our API. The tool is basically just a glorified curl client, interacting with the API via HTTPS ...
- 1,465
2
votes
0
answers
85
views
Does the SSL/TLS lifetime change affect client certificates?
From 2020.09.01 Google, Apple an Mozilla changed the maximum trust time to 398 days. I'm working on a project, where the client also authenticates itself with a certificate. This certificate is stored ...
- 21
2
votes
0
answers
179
views
How to securely manage generating files on the client-side to download
While searching for a way to convert an HTML table to .CSV file, I found there are 2 ways to generate files to download on the client side with JavaScript:
using data URLs
by generating the file on ...
- 296
2
votes
0
answers
153
views
Key Management and Authentication in Note Taking App with Client-Side Encryption
I've been working for some time on a pet project of mine: a note-taking application similar to Evernote with the difference that all content is client-side encrypted. I would like to get some feedback ...
- 201
2
votes
0
answers
349
views
Safe to Encrypt ClientId (Integer value) to use as Client Key?
Asked a follow up question (see this link).
Based on my understanding, I have to issue an unique ClientId and Client Secret Key to the API subscribers right after the registration phase (client lives ...
- 129
1
vote
1
answer
122
views
How to prevent shopping cart alterations in another tab when paymentintent is already created?
Has anyone figured out a solution to this? I seem to have gotten to the same conclusion with no solution.
If I were to go the my app's checkout page, the payintent is created in the backend (explained ...
- 11
1
vote
1
answer
812
views
Java Applet AccessControlException
I am doing a security course and a module on client side attacks, which is why this post might seem evil or outdated.
I have a Java applet fetching a malicious jar file and trying to then download ...
- 149
1
vote
1
answer
314
views
Metasploit: java_signed_applet attack hangs after user response
I am trying to perform a client side attack with Metasploit on a 32 bit Windows 7 Professional N (SP1) victim. I have Windows Defender and Firewall disabled and Java Control Panel Security set at ...
- 29
1
vote
0
answers
194
views
Client Side Encryption - The Last Mile
Is there any best practice on how to handle "the last mile" in a cloud stored, client side encrypted scenario for a web application? (Sensitive data has to be encrypted before being sent and stored on ...
- 111
1
vote
0
answers
516
views
Client authentication using certificates in M2M communication
We're planning to implement following scenario for a secure machine-to-machine (M2M) communication network. We have some gateways and a lot of secure sensors which should only be able to "speak" to ...
- 261
1
vote
0
answers
467
views
How to make CNG certificates available for mutual authentication in browser?
I have implemented a CNG key storage provider and propagate my certificate according to the answer to this question to the MY store. I can see my certificate there using the MMC console. However, when ...
- 155
1
vote
0
answers
121
views
Mutual auth client certs for a pool of requesting servers behind a proxy
I've got a situation that is puzzling me. We have a vendor that is requiring mutual authentication when making a request to them. They are requesting we give them a client cert identifying our ...
1
vote
0
answers
296
views
How Secure Would Client Side Sha-512 Be In JavaScript
I've created an Capture The Flag challenge for me and a few of my mates, and for the final challenge, you're goal is to log in as admin to a site. Now the site doesn't use any server side languages (...
1
vote
0
answers
132
views
Possible vulnerabilities in private chat application implemented using web broadcasting
I have never used web-sockets but I am working in a PHP framework which has builtin broadcasting facility. This broadcasting use web-sockets technologies named Redis and Pusher.
The workflow of this ...
- 526
1
vote
1
answer
207
views
Client Side Encryption algorithm: security + is padding algorithm needed in this case?
I will be using CSE for a web application as follows.
Generate a random AES key
Encrypt the cleartext data with this AES key
Encrypt the AES key with the service's public key, using RSA
Obviously, ...
- 217
0
votes
1
answer
51
views
How to reliably identify referrer on client browser?
Is there any way to reliably identify the referring site on modern browsers (not considering manual HTTP requests outside of a browser e.g. cURL, etc.)?
Referrer header will not work because the ...
- 113
0
votes
0
answers
196
views
CSP for Single Page App: Use client-side nonce for securing iframe content
Goal I'd like to tighten my Content Security Policy.
Situation
I have a single page react application (= All code and styles are bundled together into a bundle.js file). The file is simply placed on a ...
- 101
0
votes
0
answers
58
views
client side certificate installed on ios 16 are not being sent by browsers on that device when a server requests for a identity cert
I have a client side certificate from cloudflare (non-root) that i install on our devices in order to gain access to our sites that ask for a client side certificate from browsers. This works ...
0
votes
0
answers
70
views
How to turn a relative path script (js) import to an absolue one with a url for XSS ? (more details below)
I have a parameter whose value is injected in the HTML as the following
<script src="/dir1/dir2/dir3/dir4/INJECT_HERE"> </script>
I was able to traverse back to just / but when ...
0
votes
0
answers
48
views
Can you trust VPN clients on Windows?
I want to use a commercial VPN. It's more reliable when using their own client, since it can automatically select and switch servers etc. But what about the security?
On my Android phone, the apps are ...
- 371
0
votes
0
answers
160
views
A way to provide a TLS certificate that is not self-signed or using AWS private certificate authority
I need to secure the communications between my frontend and backend. My frontend resides in a PHP server owned by DonDominio (web hosting) and my backend in an instance in AWS.
My public web domain is ...
0
votes
0
answers
224
views
Client-side encryption of data, but the server can also add data without reading stored data
For a new application I'd like to store messages for each user's account on a centralized server.
The user accesses the application through a SPA javascript web app through their browser.
These ...
- 1
0
votes
0
answers
91
views
Can we know which client side script is performing a particular action on a website?
Recently in an website I had noticed that the data which is received from the server is not the data that is being displayed.I think it would have been modified on client-side. So, Is there any way by ...
- 1
0
votes
0
answers
356
views
A strategy to allow select split-tunneling for printing
A topic has come up with some colleagues that appears to be a 'regular' and I thought to ask the forum:
We have had use-cases for remote workers who VPN to the corporate network, which does not ...
- 136
0
votes
0
answers
82
views
Security of password to database in 2-layer SW model
I'm struggling with kinda old application which is written for Windows and has a 2-layer approach, meaning that the client SW is connecting to backend database directly.
This of course mean that the ...
- 1,109
0
votes
0
answers
89
views
Deny/Identify compromised machine sending information to a server?
i was wondering - consider i have 2 machines - client and server. the Client is opened to the internet, and sends very sensitive data to the server.
If fake data will be sent to the server and is ...
- 189