New answers tagged header
0
Not really.
The cost of a 302 Redirect should be negligible.
Moreover, most browsers detect an infinite loop at the second or third iteration (if no cookies are involved, then at the second). So you're getting double or triple load for that one endpoint; it's no great mischief.
If this is caused by a bug such as a wrong .htaccess rewrite rule, so that all ...
1
Because I don't have uri here, the report will not be sent, so there
is no additional security at all.
You are right.
In case enforced is not specified, as in your case, and browser detects a CT violation, e.g. because a mis-issued certificate is used or because of misconfiguration of your web site, it makes sense to report it to the web site owner. Then, ...
0
A server side vulnerability in your API could allow an attacker to read the request headers. For example, an injection vulnerability allows attacker generated code to run on the server. This could be tweaked to view the request headers. To mitigate this (and potentially other vulnerabilities), take your API through the OWASP Web Security Testing Guide. Also, ...
1
If https is used, then the connection is over SSL/TLS. In that case, SSL/TLS provides authenticity, integrity, and confidentiality for all request headers and response headers, just as it does for the request bodies and response bodies. Only the endpoints of the SSL/TLS connection can see the plaintext of these; and (for all intents and purposes) these are ...
1
... an attacker ...
There is no generic attacker and there is no generic attack target. If you mean an attacker in front of the proxy then they will not be able to access the API key provided " that the API does not do anything silly".
If the attacker can compromise the proxy though or can use an information leak in the proxy with access to the ...
Top 50 recent answers are included
