Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [url]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
5 votes
3 answers
5k views

Is random URL token secure enough for file attachments and other user content? [duplicate]

Lets say we have a hypothetical system where there are various files are added by users and are sensitive, e.g. lets say an attachment to a private message. It's not that easy to verify access rights ...
Ilya Chernomordik's user avatar
134 votes
4 answers
32k views

Is it safe to include an API key in a request's URL?

Lately I've seen plenty of APIs designed like this: curl "https://api.somewebsite.com/v1/something&key=YOUR-API-KEY" Isn't it elementary that passing an API key in a query string as a part of ...
Incerteza's user avatar
  • 2,247
61 votes
3 answers
8k views

Security risks of fetching user-supplied URLs

We are considering to add the following feature to our web application (an online product database, if it matters): Instead of uploading an image, the user can provide the (self-hosted) URL of an ...
Heinzi's user avatar
  • 3,088
36 votes
3 answers
12k views

Is HTTPS URL in plain text at first connection? [duplicate]

Let’s say I have never connected to the site example.com. If this site is https and I write https://example.com/supersecretpage will the URL be sent in clear text since it's the first time I connect ...
user104545's user avatar
9 votes
1 answer
1k views

How can Google search change the location in a URL tooltip?

When hovering over a website link in Google search the tooltip says the link of the website (stackoverflow.com). But when I click it it goes to some Google page and then StackOverflow. But now if I go ...
Suici Doga's user avatar
2 votes
2 answers
5k views

privacy - Which parts of URL is protected by HTTPS? [duplicate]

Assuming the website I visit uses HTTPS, which parts of the URL is protected from the eyes of my ISP? eg; https://subdomain.domain.com/path/file.php?param=value I know that domain.com (and probably ...
jonjaq's user avatar
  • 29
1 vote
1 answer
3k views

Can just clicking on a malicious link lead to hacking of my device? [duplicate]

I was not sure about it and I got some answers from internet but didn't get the logical reasoning behind it. If I just click on a malicious link it might open a new tab, or it might download something....
Porcupine's user avatar
  • 111
19 votes
3 answers
4k views

How to defend against homograph attacks?

Referring to this Wikipedia example of an homograph attack, the URL of Wikipedia had the Latin characters A and E replaced with a similar Cyrillic copy (wikipediа.org). These characters look so ...
toffee.beanns's user avatar
11 votes
2 answers
2k views

How to handle media files from untrusted sources?

I've been a heavy user of ffmpeg-based players and encoders for years, and though I've heard about numerous security issues, I always assumed that staying up-to-date was safe enough. However, I just ...
Dmitry Grigoryev's user avatar
6 votes
1 answer
2k views

Security requirements for one time access code/token in the url

I have an application that will send an SMS reminder for user containing a URL to log on. I would like to avoid user typing in username/password and log him in directly. For that I plan to use an ...
Ilya Chernomordik's user avatar
4 votes
2 answers
2k views

S3 Bucket Name Obscurity as Security

Edited to clarify: *The bucket is used by EC2 instances that process its data and display parts of it to the user. The EC2-S3 interaction is invisible to the user. * Can I assume that a public S3 ...
David_Springfield's user avatar
129 votes
10 answers
16k views

Should I contact the manufacturer if their product allows access to other users' location information?

I recently purchased a satellite communicator that allows me to send a map of my location to friends and family while I'm hiking in the wilderness. While testing out my product, I noticed that the ...
Lil' Bits's user avatar
  • 1,143
49 votes
1 answer
12k views

In SQL injections why do they put "-- -" at the end of the URL?

I understand when they put a + at the end, URL treats it like a space. I want to know what -- - does. I do know what the "double dash" does. Including the double dash with a "space at the end". I ...
Linux Newbie's user avatar
20 votes
4 answers
37k views

Is it possible to sniff HTTPS URLs? [duplicate]

From many posts, I know that almost everything in HTTPS or SSL connections is encrypted. Still, I am wondering, if it is possible to get the URLs out of such a connection if the computer that opens ...
jdoe's user avatar
  • 311
8 votes
1 answer
1k views

What is the name for this type of URL attack?

Say a PHP page accepts URL path as a POST parameter (like the answer to this question): $path = $_POST['url_path']; file_get_contents('http://example.com' . $path); A maliicious user POSTs url_path ...
SilverlightFox's user avatar
7 votes
1 answer
599 views

Is it safe to allow CSS filter: url(data:<SVG SOURCE HERE>)?

We have a web service where logged in users can create web page content and write custom CSS for their pages. All the HTML goes through a whitelist parser and doesn't allow any executable content. All ...
Mikko Rantalainen's user avatar
5 votes
2 answers
976 views

Is URL redirection in PHP safe if I use ../../ as a prefix?

I am developing a PHP web app and I'm in the process of implementing a redirection functionality. I know that redirection can be dangerous when it can be set on the client side and I use ../../ as a ...
ozzi-'s user avatar
  • 53
4 votes
2 answers
1k views

Can random subdomain naming enhance security?

I have a bunch of services which I want to group under a subdomain. Somehow 2-factor authentication is not possible to identify the users of these services. I have a thought to have randomly named ...
Navjot Singh's user avatar
3 votes
1 answer
4k views

Is it safe to whitelist CDN domains?

I am trying to whitelist URLs for my PC but I want to eventually roll out the rules to my small company's firewall. But I'm having trouble with CDNs since a page may load content from many distinct ...
JuanKB1024's user avatar
2 votes
0 answers
571 views

Using UUIDs for non-guessable URLs [duplicate]

How safe is using UUIDs as URL identifier for non-guessable IDs? Specifically UUIDs generated by Python's uuid4() function, using base64 encoding. E.g. https://example.com/content/...
Mikko Ohtamaa's user avatar
2 votes
2 answers
3k views

Modify Javascript Variable with URL Exploit

Is it possible to set a javascript variable through the URL? Here's an example of the code I'm trying to modify: <script type="text/javascript"> var x = 0; </script> Is there a way to ...
Josh B.'s user avatar
  • 123
1 vote
2 answers
131 views

Does HTTP protocol interpret contents of cookies and query strings in URL, whereas it doesn't interpret message bodies?

HTTP knows to look for user names and passwords in authorization headers in HTTP requests. So this is at HTTP level. Is it correct that putting user passwords into message bodies of HTTP requests is ...
Tim's user avatar
  • 657
1 vote
1 answer
8k views

Preventing reflected XSS in URL [duplicate]

We have just had some pen testing completed against a web application and the one area identified as High Impact and Medium Probability was: Cross-Site scripting (reflected) The example given was ...
bhttoan's user avatar
  • 173
0 votes
1 answer
162 views

Is it necessary to use cryptographically-secure randomness in order to create URLs for user activation?

Usually once you register in a website you need to visit a url like: https://example.com/user_activate/^random_string^ Does the ^random_string^ necessarily need to be cryptographically pseudorandom ...
Dimitrios Desyllas's user avatar
0 votes
1 answer
469 views

Is session id in url itself for all the requests an issue? [closed]

Is session id in url itself for all the requests an issue?
user avatar
0 votes
3 answers
2k views

Access Key In URL - Securing The Unsecured!

I'm having some difficulties doing this the right way (as much as it can go). Some time ago, I've asked a question here, asking for help on how to implement sending an access link through email. ...
Neta's user avatar
  • 133