Search Results
| Search type | Search syntax |
|---|---|
| Tags | [tag] |
| Exact | "words here" |
| Author |
user:1234 user:me (yours) |
| Score |
score:3 (3+) score:0 (none) |
| Answers |
answers:3 (3+) answers:0 (none) isaccepted:yes hasaccepted:no inquestion:1234 |
| Views | views:250 |
| Code | code:"if (foo != bar)" |
| Sections |
title:apples body:"apples oranges" |
| URL | url:"*.example.com" |
| Saves | in:saves |
| Status |
closed:yes duplicate:no migrated:no wiki:no |
| Types |
is:question is:answer |
| Exclude |
-[tag] -apples |
| For more details on advanced search visit our help page | |
Results tagged with web-application
Search options not deleted
user 32934
An application that is accessed over a network such as the Internet or an intranet using a browser.
1
vote
Application is validating the file extension but not file content - Is this a security vulne...
You should not trust any extension on files in general, special if your services offers functionality for upload files. If you service offers a service for upload files my recommendation is to use a a …
- 2,294
1
vote
Which is the main purpose of having two domains pointing to the same IP, one of them without...
One of the reasons could be that some old system needs to operate with the one that don't have TLS support, but nowadays is a it strange that you don't have TLS support on the client
- 2,294
1
vote
Does HTTP protocol interpret contents of cookies and query strings in URL, whereas it doesn'...
I think this depends on the HTTP library that handles the requests, for example, in theory if the content of a POST message is json and the content-type is set to text/html the responsibility of give …
- 2,294
1
vote
Security risks downloading external images automatically from script
From my point of view you need to follow the next steps to make it secure the download of the images.
Download the image with read only permissions on the box.
Verify the format of the received file …
- 2,294
1
vote
Can a URL contain executable JavaScript?
A URL (Uniform Resource Locator) in general is compose of the destination host and the URI (Uniform Resorce Identifier). The URI can contains whatever, a string with delimiters /, a base64 encoding, a …
- 2,294
0
votes
Transfer encrypted objects and decrypt in browser
In general when you need to transfer encrypted data over the Internet in a client server architecture with HTTP the recommendation is use TLS/SSL, some people referees also as Secure Sockets. And I th …
- 2,294
0
votes
How to mitigate risk of exploiting open POST endpoints?
In general attacks on POST operations are:
Memory exhaustion attacks. The attacker sends a big payload on the POST for exhaust internal buffers/memory that handles the data. (For example Slowloris). …
- 2,294
0
votes
What simple security considerations can I / should I make for a read-only API?
My approach for verify security APIs is to design security functional tests that verifies the robustness of the system. Test top 10 OWASP is fine for verify you are not vulnerable to attacks but I thi …
- 2,294
-1
votes
How does a NG Firewall do application visibility and classification of TLS traffic without T...
The identification of the traffic is in general made by using DPI, that is basically check specific parts of the packets for determine and application or a type of traffic. For example HTTP traffic fr …
- 2,294