Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [web-application]

An application that is accessed over a network such as the Internet or an intranet using a browser.

Filter by
Sorted by
Tagged with
0 votes
1 answer
72 views

Do I need to implement additional security measures for my self-hosted container web app?

Could you please suggest if I need to do anything else to ensure that my server is secure against the most common attacks? Currently it seems fine to me, but I would highly appreciate if someone with ...
dooshnila's user avatar
0 votes
0 answers
49 views

Tabnabbing, adblocking and web browser security

My question regards tabnabbing and how to block it. I will first describe my understanding of the subject, but I'm no expert, so this introduction is meant for you to correct me if applicable. Here is ...
greg27's user avatar
  • 19
0 votes
2 answers
122 views

"Duplicate" of Chrome Tabs causes stale tokens

Our implementation for authentication works like this User provides username/password to /login API API returns access token and refresh token in payload We store the access token and refresh token ...
Vin Xi's user avatar
  • 53
0 votes
1 answer
51 views

Why would an application I've never used show up on my NAT sessions? [closed]

I was looking through my session logs and I see that Snapchat shows up. I don't use Snapchat. Never have. It's not a website I've ever even visited. The host for the session is the computer I'm on now,...
captainentropy's user avatar
1 vote
0 answers
59 views

Group admin in end-to-end encrypted group chat

I was thinking about building a simple end-to-end encrypted chat with group chat capabilities. Please keep in mind that 1) it's just an experiment to help me learn more about cryptography and 2) I'm ...
Tryer outer's user avatar
0 votes
0 answers
39 views

WAF vs. Application Layer for Bot Mitigation

In a layered enterprise security architecture with a Web Application Firewall (WAF) deployed in the DMZ, should there be shared responsibility between the WAF and application layer/ microservices for ...
Fahim Farook's user avatar
0 votes
0 answers
49 views

Content security policy (CSP) reports that seem unrelated to the web app

I've setup Content Security Policy (CSP) on a web app. For the time being it's set to report only so that I can assess it first in production and then turn it on if things get clear. But so far they'...
Robert Koritnik's user avatar
0 votes
0 answers
67 views

httpOnly Session Cookies in an iframe context in the future w/o SameSite=None

My website is using session cookies (w/ SameSite=Lax, secure, httpOnly attributes) and a CSRF Token stored in localStorage. Recently I developed a teams app, which essentially loads the website ...
user4503817's user avatar
0 votes
2 answers
62 views

"Update my email", best way to prevent enumeration?

"Update my email" page has 2 fields: the new email and the current password. I cannot find the correct way to protect against user enumeration if there's an error on the email field: if I ...
Sumak's user avatar
  • 103
0 votes
0 answers
44 views

Preserving network segmentation for cloud web app in a user friendly way

Assuming a team maintaining multiple simple cloud web apps with associated secret key stores. The control plane for the app needs to access secrets, and we don't want to expose the secret store on the ...
Petter Kvalvaag's user avatar
0 votes
1 answer
68 views

Benefits of random responses to exceptions over generic error responses

Attackers can send requests with data that the server does not expect in order to try to get responses that reveal secret data. One common example is when the server experiences an exception. A poorly ...
n-l-i's user avatar
  • 326
2 votes
1 answer
82 views

Account recovery protocol when email is breached, or inaccessible?

I am creating a web application for individual accounts. The email address is also used as the user name. 2FA is setup for the user to optionally use. I've been trying to wrap my head around preparing ...
eaglei22's user avatar
  • 121
0 votes
0 answers
66 views

Does load balancing pose extra security risks?

If I'd have a basic Laravel back-end application I'd configure my load balancing using Nginx. I would have one server with the sole purpose of load balancing. The other servers would contain my ...
O'Niel's user avatar
  • 2,914
0 votes
2 answers
104 views

How to Capture Mobile API Requests in burp when Server side pinning is implemented

I recently encountered a scenario where Mobile Application is generating CSR request, call a POST API request and in response, Ask Server for certificate. Server will respond with the temporary ...
Tejas Pandya's user avatar
0 votes
0 answers
59 views

storing user hashed password into webauthn id

I am building a pure client-side app. My users have a .kdbx vault stored in localStorage, and they can open it with a password. In order to add a biometric\quick open feature into the app I thought ...
Wazime's user avatar
  • 101
0 votes
1 answer
136 views

What are possible security considerations of using ULID for unique identifiers?

ULID is a specification for unique identifiers which is intended as an alternative to traditional UUID. Some of the major differences are: The creation date of the identifier is encoded into part of ...
Garrett Albright's user avatar
0 votes
0 answers
84 views

Any "smart" way to disable telemetry of a web application on OS/hardware level? Any specific guide/tool recommend if we use linux and lnmp env

Let's say we know as a fact that a php web application baked in telemetry to collection data. Without scanning through the codebase, any quick hack tool that we can force the telemetry become useless ...
Maxfield's user avatar
  • 157
0 votes
1 answer
114 views

Algorithms when using client side hashing plus server side hashing

So if I got this right from my intense research, the following procedure would be preferrable: Use the PBKDF2 key derivation function to derive a secret key from the users password on the client side. ...
shaniag's user avatar
0 votes
1 answer
69 views

javascript app preventing csrf

I am trying to implement measures against csrf in my client spa. I have the following question, since it is difficult for me to use the Signed Double-Submit Cookie. It is possible to implement a csrf ...
juan juanito's user avatar
2 votes
1 answer
149 views

Securely storing derived key in web app and handling user identity

I am currently working on an open source project to securely store notes, payment card numbers, etc. I would like to implement a zero knowledge encryption method so that no one but the user can ...
mson's user avatar
  • 21
0 votes
1 answer
192 views

Is encrypting a query parameter within a URI a security best practice?

Assumption a customer is sitting in a public area connected to a public wifi. Step 1. example.com server sends the following information to trustworthy.external.domain over https: redirectPath="...
user1068636's user avatar
0 votes
0 answers
77 views

What is the correct way to implement a change-of-email request flow?

I am currently implementing a change-of-email request flow for a web service without MFA. My initial approach is to consult the current OWASP Guide for such a flow. In reading the document, I've ...
peteredm's user avatar
0 votes
2 answers
129 views

how should a web application verify a redirect comes from a trustworthy source?

This document has a sequence diagram (annotated and shown below) explaining how Stripe handle's a Checkout Session. My question : When a customer is returned to the successUrl = www.example.com/some/...
user1068636's user avatar
0 votes
0 answers
120 views

Where to store user private keys in a webapp? [duplicate]

I'm building a webapp where I want to encrypt user data. I've done A LOT of research about this. The main issue is that I want only users to be able to access their data. After reading countless ...
nick's user avatar
  • 101
0 votes
0 answers
64 views

I'm not sure why the different XXE injection payloads follow a specific pattern

I'm quite new to XXE attacks so please bear with me, when I look at the different payloads to get a OOB XXE they all look like the following (external DTD) : <!ENTITY % file SYSTEM "file:///...
Programer.new's user avatar
0 votes
1 answer
131 views

How to protect a local app that acts as a webserver from exploits?

For me building interfaces through HTML / JS frameworks is by far easier then any other framework I have tried in the past. It's also not that strange, as by far the most UIs are based on the web ...
Dirk Boer's user avatar
  • 389
0 votes
1 answer
73 views

Can token decryption endpoint response codes variability lead to security vulnerabilities?

To clarify the question, here's our case: We generate encrypted tokens by applying AES-CBC (256 bit) and Base64 to payload: encrypted_token = Base64.encode(AES_CBC_256.encrypt(key, iv, payload)). ...
vetements's user avatar
0 votes
1 answer
123 views

Why don't operators and CMS developers of discussion forums offer 2FA?

I have now done the tedious work and enabled 2FA for all accounts in my gopass (if the site offered an option). Some only offer insecure SMS or a proprietary app, or even nothing at all. What is ...
Sybil's user avatar
  • 1,479
0 votes
0 answers
89 views

User-Controlled Encryption in web app. How to Implement Encrypted Content Sharing Among Friends?

I'm working on idea for a project the goal is to allow a user to share their encrypted content with friends while ensuring the server and none friends maintains zero knowledge of the actual content. ...
Reed Jones's user avatar
2 votes
2 answers
146 views

IDOR or something else?

While analyzing a web application, I identified a path of the type https://example/remove/123, which allows a user with lower privileges to remove a report created by a user with higher privileges. In ...
hagick's user avatar
  • 23
0 votes
0 answers
25 views

hydra returns all passwords tested as found [duplicate]

i have tried this command hydra localhost http-form-get "/DVWA-master/vulnerabilities/brute/?username=^USER^&password=^PASS^&Login=submit:F=incorrect:H=Cookie\:security=low; PHPSESSID=...
youssef blt's user avatar
0 votes
1 answer
264 views

SSRF trough Gopher

Gopher protocol is used a lot when exploiting SSRF, but how? a Gopher URL takes the form: gopher://<host>:<port>/<gopher-path> but let's take this example: gopher://10.10.10.3:80/...
jeff's user avatar
  • 3
2 votes
0 answers
168 views

CSP: Allow inline scripts while blocking javascript: in iframe src

We wan't to prevent attacks comming in from src attribute "javascript:" but still allow lnline script tags. Currently the only option is to add sha-hash's but there are too many inline ...
Chris Gunawardena's user avatar
2 votes
0 answers
42 views

How to detect if a user tries to access my web service using proxies/vpn? [duplicate]

I believe this question is covered as the problem is straightforward. But, as I am building a web service from scratch, I'd like to have some advice on how to do it better. Let's say my web service ...
Sergei Basharov's user avatar
1 vote
0 answers
161 views

Best practices for access and refresh tokens timeout lengths [duplicate]

I'm currently working on an international marketplace website and trying to decide the appropriate timeout lengths for access and refresh tokens. We try to do the timeouts to be as strict as possible ...
Arnas Savickas's user avatar
1 vote
1 answer
131 views

Risk of using scripting language on backend?

If you are using a scripting language like for example Python for the back-end of a web-service, is there a risk connected to this which is not present if you would use a compiled language? Take for ...
O'Niel's user avatar
  • 2,914
0 votes
1 answer
203 views

How to isolate VMs with internet exposed websites on my home network?

I want to host some websites served from an isolated VM which is on my home network through port forwarding. Although I believe this is reasonably safe, I want to physically segment internet-exposed ...
aughhhhhhh's user avatar
1 vote
1 answer
93 views

Will these actions better secure my web app

I'm trying to figure out what else I should (not) do to reduce the possibility of my web app getting hacked. And like most development efforts, while it would be great to have a security expert on the ...
David Thielen's user avatar
0 votes
1 answer
315 views

Is Using an Authenticator App on the Same Device as the Passwordless Application a True 2FA?

I am building an application that a user can receive an access to by an internal worker. This works using a magic link, where the user will receive a one time link to authenticate in the app. Now I ...
Luka Demetrashvili's user avatar
0 votes
0 answers
75 views

Is POST-based XSSI possible?

With standard XSSI, an attacker can include a remote script which contains user-bound secrets across origins, and then read them out. I have an endpoint which returns sensitive Javascript code, but ...
tim's user avatar
  • 29.6k
0 votes
1 answer
91 views

Is it necessary to implement both Content-Security-Policy and X-Content-Type-Options for ensuring the security of a website?

Is it necessary to implement both Content-Security-Policy and X-Content-Type-Options for ensuring the security of a website?
Vikas's user avatar
  • 9
0 votes
1 answer
196 views

Does Firebase App Check provide CSRF protection?

Quoting the OWASP Cheat Sheet on CSRF Prevention: Using the Synchronizer Token Pattern: CSRF tokens should be: Unique per user session. Secret Unpredictable (large random value generated by a secure ...
Joel Burget's user avatar
0 votes
0 answers
149 views

How to implement secure E2EE for a managing App

TL;DR Is it possible to create an end-to-end encrypted web application where newly created users are able to access data encrypted before their creation? My plan is to develop a (let's call it a ...
Kndo2378's user avatar
0 votes
1 answer
101 views

Login/Registration: why is not telling the users they got their username wrong during login, if registration already hint username existence?

It's considered a best practice in security for login form to provide a vague error message your username or password is wrong rather than the more precise: username does not exists wrong password ...
allan.simon's user avatar
7 votes
2 answers
2k views

What happens if a DNS record points to non-controlled IP address?

If a domain, for example foo.com is pointed to a IP address (A record) outside of my control, for example the Twitter IP address. And the domain is visited using a browser: What will be displayed in ...
Ghost Rider's user avatar
1 vote
1 answer
323 views

How safe it is to view PDF file in browser without downloading the file into PC?

When I view the PDF file in a browser such as FireFox without downloading the file into my PC, does FireFox temporarily store the PDF file in my PC? I heard that FireFox has been sandbox heavily and ...
JUZ Aviewer's user avatar
0 votes
0 answers
95 views

TLS session keys [duplicate]

I Have a confusion here. From what I know, in TLS1.2, the Client sends Client Hello and then the Server Sends a Server Hello, Certificate(with its public key) and Certificate chain, and then a Server ...
RRHS's user avatar
  • 133
0 votes
0 answers
295 views

How to escalate or make a Self-XSS vulnerability more impactful when injecting a payload into the X-Forwarded-For header of a web request?

I'm a beginner bug bounty hunter, and I recently came across a Self-XSS vulnerability during my security testing on a target website. The vulnerability occurs when I inject a payload into the X-...
Giancarlo Eduardo's user avatar
-2 votes
2 answers
176 views

How to learn to secure Web Applications? [closed]

The server is based on Linux and applications are based on Android and iOS. I was looking through "Linux Hardening Guide" as someone recommended it to me in order to harden Linux servers. I ...
Team B.I's user avatar
  • 141
0 votes
0 answers
111 views

Proper HIPAA security

I am a sysadmin, though not security-specific. I was recently stunned to receive an automated email from my physician's office (in USA) containing an HTTP link to their website for the completion of ...
Charles Nix's user avatar

1
2 3 4 5
68