Questions tagged [url]
The url tag has no usage guidance.
Is random URL token secure enough for file attachments and other user content? [duplicate]
Lets say we have a hypothetical system where there are various files are added by users and are sensitive, e.g. lets say an attachment to a private message. It's not that easy to verify access rights ...
Is it safe to include an API key in a request's URL?
Lately I've seen plenty of APIs designed like this: curl "https://api.somewebsite.com/v1/something&key=YOUR-API-KEY" Isn't it elementary that passing an API key in a query string as a part of ...
Security risks of fetching user-supplied URLs
We are considering to add the following feature to our web application (an online product database, if it matters): Instead of uploading an image, the user can provide the (self-hosted) URL of an ...
Is HTTPS URL in plain text at first connection? [duplicate]
Let’s say I have never connected to the site example.com. If this site is https and I write https://example.com/supersecretpage will the URL be sent in clear text since it's the first time I connect ...
How can Google search change the location in a URL tooltip?
When hovering over a website link in Google search the tooltip says the link of the website (stackoverflow.com). But when I click it it goes to some Google page and then StackOverflow. But now if I go ...
How to handle media files from untrusted sources?
I've been a heavy user of ffmpeg-based players and encoders for years, and though I've heard about numerous security issues, I always assumed that staying up-to-date was safe enough. However, I just ...
Security requirements for one time access code/token in the url
I have an application that will send an SMS reminder for user containing a URL to log on. I would like to avoid user typing in username/password and log him in directly. For that I plan to use an ...
S3 Bucket Name Obscurity as Security
Edited to clarify: *The bucket is used by EC2 instances that process its data and display parts of it to the user. The EC2-S3 interaction is invisible to the user. * Can I assume that a public S3 ...
privacy - Which parts of URL is protected by HTTPS? [duplicate]
Assuming the website I visit uses HTTPS, which parts of the URL is protected from the eyes of my ISP? eg; https://subdomain.domain.com/path/file.php?param=value I know that domain.com (and probably ...
Should I contact the manufacturer if their product allows access to other users' location information?
I recently purchased a satellite communicator that allows me to send a map of my location to friends and family while I'm hiking in the wilderness. While testing out my product, I noticed that the ...
In SQL injections why do they put "-- -" at the end of the URL?
I understand when they put a + at the end, URL treats it like a space. I want to know what -- - does. I do know what the "double dash" does. Including the double dash with a "space at the end". I ...
How to defend against homograph attacks?
Referring to this Wikipedia example of an homograph attack, the URL of Wikipedia had the Latin characters A and E replaced with a similar Cyrillic copy (wikipediа.org). These characters look so ...
Is it possible to sniff HTTPS URLs? [duplicate]
From many posts, I know that almost everything in HTTPS or SSL connections is encrypted. Still, I am wondering, if it is possible to get the URLs out of such a connection if the computer that opens ...
What is the name for this type of URL attack?
Say a PHP page accepts URL path as a POST parameter (like the answer to this question): $path = $_POST['url_path']; file_get_contents('http://example.com' . $path); A maliicious user POSTs url_path ...
Is it safe to allow CSS filter: url(data:<SVG SOURCE HERE>)?
We have a web service where logged in users can create web page content and write custom CSS for their pages. All the HTML goes through a whitelist parser and doesn't allow any executable content. All ...
Is URL redirection in PHP safe if I use ../../ as a prefix?
I am developing a PHP web app and I'm in the process of implementing a redirection functionality. I know that redirection can be dangerous when it can be set on the client side and I use ../../ as a ...
Is it safe to whitelist CDN domains?
I am trying to whitelist URLs for my PC but I want to eventually roll out the rules to my small company's firewall. But I'm having trouble with CDNs since a page may load content from many distinct ...
Using UUIDs for non-guessable URLs [duplicate]
How safe is using UUIDs as URL identifier for non-guessable IDs? Specifically UUIDs generated by Python's uuid4() function, using base64 encoding. E.g. https://example.com/content/...
Does HTTP protocol interpret contents of cookies and query strings in URL, whereas it doesn't interpret message bodies?
HTTP knows to look for user names and passwords in authorization headers in HTTP requests. So this is at HTTP level. Is it correct that putting user passwords into message bodies of HTTP requests is ...
What type of attack is this? '
This is the example query: GET directory/file.txt?lang=it' HTTP/1.1 I don't know what language it is. The ' (single quote) reminds me of a SQL Injection. I don't think it's a typo because I saw ...
Preventing reflected XSS in URL [duplicate]
We have just had some pen testing completed against a web application and the one area identified as High Impact and Medium Probability was: Cross-Site scripting (reflected) The example given was ...
Is it necessary to use cryptographically-secure randomness in order to create URLs for user activation?
Usually once you register in a website you need to visit a url like: https://example.com/user_activate/^random_string^ Does the ^random_string^ necessarily need to be cryptographically pseudorandom ...
Can just clicking on a malicious link lead to hacking of my device? [duplicate]
I was not sure about it and I got some answers from internet but didn't get the logical reasoning behind it. If I just click on a malicious link it might open a new tab, or it might download something....
Is session id in url itself for all the requests an issue? [closed]
Is session id in url itself for all the requests an issue?