Podcast #128: We chat with Kent C Dodds about why he loves React and discuss what life was like in the dark days before Git. Listen now.
Search type Search syntax
Tags [tag]
Exact "words here"
Author user:1234
user:me (yours)
Score score:3 (3+)
score:0 (none)
Answers answers:3 (3+)
answers:0 (none)
isaccepted:yes
hasaccepted:no
inquestion:1234
Views views:250
Sections title:apples
body:"apples oranges"
URL url:"*.example.com"
Favorites infavorites:mine
infavorites:1234
Status closed:yes
duplicate:no
migrated:no
wiki:no
Types is:question
is:answer
Exclude -[tag]
-apples
For more details on advanced search visit our help page
Results tagged with Search options user 655

An application that is accessed over a network such as the Internet or an intranet using a browser.

3
votes
I suppose your site uses HTTPS. If it does not, do it now. Now that your site uses HTTPS, you can use a "private path": make the root URL for the site look like: https://www.yourserver.com/hjgw478fsu …
answered Apr 16 '13 by Thomas Pornin
13
votes
For a homebrew framework, a competent programmer is not sufficient. You need a competent programmer who has time to devote to both implementation and subsequent maintenance, and who will still do it t …
answered Feb 17 '13 by Thomas Pornin
1
vote
If some malware on the user side makes the client buy 2 millions of items on your site, and your site performs the transaction without raising any alert, then some people, in particular the defrauded …
answered Jul 13 '14 by Thomas Pornin
6
votes
Source code life cycle and key management may conflict. For instance, you may (should) use a versioning tool such as Subversion to store the successive modifications you perform on the source code; if …
answered Oct 3 '11 by Thomas Pornin
3
votes
You don't validate input strings in abstracto. You validate strings for a specific purpose. When a malicious user works around a validation system by using Base64, this means that the validation syst …
answered Apr 16 '13 by Thomas Pornin
3
votes
Ideally you would like to manually inspect any abnormal occurrence. Since there are only 24 hours per day, this necessarily implies some heavy pruning, in which you automatically filter out the bulk o …
answered Jan 27 '14 by Thomas Pornin
2
votes
If your internal network is separated from the outside and all people who can physically access the cables are trustworthy (and you trust them), then you can get away with not doing SSL. If you have …
answered Oct 31 '12 by Thomas Pornin
2
votes
My bet is that this requirement is to lower the rate of username collisions, because such collisions can trigger user support (user tries his name, but the name is already taken, user does not underst …
answered Aug 27 '11 by Thomas Pornin
6
votes
If the processing of a failed login attempt, failed because the login name does not exist, incurs a smaller cost on your side than a failed login because of a wrong password on an existing login name, …
answered Sep 4 '13 by Thomas Pornin
7
votes
From the server, you may want two things: to make sure that the client sending the request is indeed who they claim; to be able to prove to third parties that whoever sent a given request is indeed …
answered Mar 15 '13 by Thomas Pornin
8
votes
3-D Secure payment systems (e.g. MasterCard SecureCode) use an iframe. Previous versions used a popup, the provenance of which being much more easily verified by the user. It apparently turned out tha …
answered Feb 21 '13 by Thomas Pornin
0
votes
For the SSL certificate(s): wildcard certificates have several issues, biggest of which being that they tend to be expensive. Indeed, the business model of most existing CA is to sell certificates. A …
answered Jan 8 '13 by Thomas Pornin
2
votes
If the signature is supposed to assert document ownership or acceptance by the user, then the power to sign should remain in the hands of the user (precisely where his "USB etoken" resides). Since sig …
answered Jul 14 '15 by Thomas Pornin
1
vote
There is one misconception held, not by the "general public", but many people more or less involved in security. It says that: "SSL/TLS has been broken so many times, it is inherently weak". In reali …
answered Aug 30 '12 by Thomas Pornin
2
votes
I suppose that your problem is about using a Web application that you do not control. That Web application requires some "user credentials" (login and password) which you do not want to show to the hu …
answered Sep 3 '13 by Thomas Pornin

15 30 50 per page