A system whose primary function is to deliver web pages on request to clients.

learn more… | top users | synonyms

0
votes
1answer
68 views

3rd Party Authentication protocol

I have a hardware device (H), phone (P) and web server (S). I would like P to be able to send commands to H but only if it is authorized to do so. Permissions are stored on server. Technically I could ...
2
votes
0answers
115 views

Securing elasticsearch behind a reverse proxy

I intend to run an Elasticsearch index to store a persistent copy of data retrieved from an external service. My plan is to host the Elasticsearch index on AWS, and have it listen on 127.0.0.1 only. I ...
1
vote
0answers
44 views

Personally identifiable information in query parameter for Tomcat REST service

I have a REST API running in a Tomcat container that has an endpoint that takes a customer email address as a query parameter. It's something like this: /customers?email=foo@bar.com Customer email ...
1
vote
0answers
50 views

What are the security implications of enabling a SNI-hole on a web server?

A web server (let's say Apache 2.4) implements SNI. It is configured with a 4096 bit SHA384-signed Wildcard Certificate (*.land.org) with a Subject Alternative Name (land.org). The Certificate ...
1
vote
0answers
40 views

Possible vulnerabilities in private chat application implemented using web broadcasting

I have never used web-sockets but I am working in a PHP framework which has builtin broadcasting facility. This broadcasting use web-sockets technologies named Redis and Pusher. The workflow of this ...
1
vote
0answers
188 views

What web browsers support ECC vs DSA vs RSA for SSL/TLS?

We are updating our wildcard certificate and see that we have the option to use both RSA or DSA with Symantec (for free), while Digicert offers 3 options for wildcards ECC, DSA and RSA. Is there a ...
1
vote
0answers
51 views

Does standard configuration in Tomcat pose any security risk?

I have a simple test website on Tomcat running on RaspberryPi. Pi is behind a router. Port forwarding is on and I can access the website from the Internet. What are the security risks of standard out ...
1
vote
0answers
44 views

How to manage security for multiple PC and VM?

I have a firewall VM which creates I have used to setup subnet for different purposes. For example: (fake ips, of course) 1.1.2.1/24 DMZ 1.1.3.1/24 Internal 1.1.5.1/24 security/logging I use ...
0
votes
0answers
93 views

Blocking IP After multiple connection with Netsh advfirewall to mitigate DDos

Hello I wanna block Ip address if they exceed 20 connections with port 80 TCP for HTTP Server. I wanna do this using Netsh advfirewall, In Linux I use IPTables: iptables -I INPUT -p tcp --dport ...
0
votes
0answers
23 views

Is it a security risk to give read/write permissions to /Library/WebServer/Documents to my main account?

The default setting is that the apache2 root-directory Documents is owned by root and I have to enter a password each time I change it. This is why I want to give full permissions to my user account ...
0
votes
0answers
194 views

OSSEC, what is it telling me about port changes?

I've been diving into OSSEC for the last couple of months, but I feel unclear on one of it's alerts. I've provided the alert below. The main difference I see in previous output and current output is ...
0
votes
0answers
90 views

Securing my API: concept of access tokens

First of all I want to excuse for the bad spelling and grammar. English is not my mother tongue. I have built a JSON communication between a front-end (website) and my Node.js web server. I want to ...