Skip to main content
136 votes

Does it make sense to consider a triggerable server software crash a DOS attack?

Yes. Any attack which has as a goal to deny the normal usage of a service by legitimate users is by definition a DoS (Denial of Service).
DarkMatter's user avatar
  • 2,691
121 votes
Accepted

Do I need CSRF token if I'm using Bearer JWT?

This is relevant but doesn't necessarily answer 100% of your question: https://security.stackexchange.com/a/166798/149676 The short of it is that as long as authentication isn't automatic (typically ...
Conor Mancone's user avatar
59 votes

Does it make sense to consider a triggerable server software crash a DOS attack?

DDoS (Distributed DoS) is characterised by floods creating a DoS (in all available definitions). A single node causing a flood successfully is kind of rare. But DoS can be caused by a broad range of ...
schroeder's user avatar
  • 131k
48 votes

Do I need CSRF token if I'm using Bearer JWT?

Generally, CSRF happens when a browser automatically adds headers (i.e: Session ID within a Cookie), and then made the session authenticated. Bearer tokens, or other HTTP header based tokens that ...
ndrix's user avatar
  • 3,306
28 votes

Predicting Math.random() numbers?

You can attack these using the Z3 theorem prover. I've implemented such an attack in Python in order to predict values in a lottery simulator. As mentioned previously, XorShift128+ is used in most ...
douggard's user avatar
  • 377
25 votes

Do I need CSRF token if I'm using Bearer JWT?

Previous answers are rock solid. I'll jump in here to provide a more context and little caveat. There are lots of ways to using JWT; session management is one of them. Although it presents a few ...
Daniel Szpisjak's user avatar
20 votes
Accepted

How to prevent directory traversal when joining paths in node.js?

Here's is one approach I've used in this situation: path.normalize() handles all . and .., so you can be sure that if either one is present, it will be at the front of the path. Remove any ../../ ...
cloudfeet's user avatar
  • 2,568
16 votes
Accepted

Cryptographically secure number generator for node.js

You are correct that Math.random() is not secure. If you want a CSPRNG in Node.js, crypto.randomBytes() is what you're looking for.
Anders's user avatar
  • 65.6k
14 votes
Accepted

Where to store private and public keys?

Public key: that's the easy part, it can be almost anywhere (known URL, some type of file store like S3/GCS/..., even source control). The only concern is to make sure it is not modified, but it can ...
Marc's user avatar
  • 4,301
10 votes

Does it make sense to consider a triggerable server software crash a DOS attack?

Quite often security is looked at as providing three properties: Availability Integrity Confidentiality In your case, you've found something that allows a user to affect the availability of the ...
sarnold's user avatar
  • 741
10 votes
Accepted

Why sign session cookies?

Apparently, the software permits developers to provide their own session IDs, which (because people are often bad at security) might be short and/or predictable. The signature is thus added to create ...
CBHacking's user avatar
  • 49.3k
9 votes

Does it make sense to consider a triggerable server software crash a DOS attack?

I wanted to add one more important detail not explicitly stated in the other answers. You said this: It works by sending the server some crafted payload, which makes the server code throw an ...
Conor Mancone's user avatar
6 votes
Accepted

What Does This Command Do? Should i be worried?

It's an attempt at command injection. IFS is basically a space in this situation, and && executes multiple commands. So you have: /language/Swedish && echo 610cker > qt && ...
tim's user avatar
  • 29.7k
6 votes

Can string comparison realistically be exploited in a timing attack on a web server?

Timing attacks are possible even if response times seem inconsistent, because you can use statistical analysis to filter out a lot of noise in the data. Average values are much more stable than ...
reed's user avatar
  • 15.8k
6 votes
Accepted

How do you securely delete httpOnly cookies previously used for login?

you cannot, you have make another request to backend from there you can remove the cookies.
Yogi Gachinmath's user avatar
6 votes
Accepted

Magic links: JWT vs random string

Would it not be more prudent to just generate a large ... string Yes, it would. A token is often a straightforward solution, and is easier to get right. Cryptographic solutions often have pitfalls or ...
Sjoerd's user avatar
  • 31.2k
5 votes
Accepted

Node.js REST server running as root

I would recommend splitting your app into multiple components communicating through standardized REST APIs. In this case you'd have a storage manager app which runs as a user with enough privileges ...
André Borie's user avatar
  • 12.8k
5 votes

How to deny access to my server end points?

First, regarding what you have tried already: header('Access-Control-Allow-Origin: https://www.example.com'); This will fail for a number of reasons: This a client-level control that doesn't stop ...
Conor Mancone's user avatar
5 votes

Is this password-less auth flow secure?

The main concept of your flow (magic links) is one of the more well known password-less alternatives for authentication. The general consensus seems to be that the security of such schemes (as has ...
AlphaD's user avatar
  • 943
5 votes
Accepted

Timing attack - Is safe to check if strings have the same length?

You are correct this implementation of constant-time string comparison will leak information about the length of some string that is being compared against an attacker controlled string. However, ...
dr jimbob's user avatar
  • 39.4k
5 votes
Accepted

Is it safe to set rejectUnauthorized to false when using Heroku's Postgres database?

Heroku does not support client-side certificate validation to its Postgres databases unless you are using Private Spaces or Shield: Unless you're using a Private or Shield Heroku Postgres database, ...
J c's user avatar
  • 166
5 votes
Accepted

How to properly invalidate JWT tokens and sessions in this use case?

You can't rely on the client code General rule of thumb: once you send code down to the client to run on the user's machine, it's not your code anymore. The only security you can count on is security ...
Mike Ounsworth's user avatar
4 votes
Accepted

Should I use a cryptograpically secure random number generator when I generate IDs?

Math.random() is usually seeded from the current time of day. Therefore there is a chance that collisions will happen for objects that are generated around the same time each day. From a security ...
SilverlightFox's user avatar
4 votes
Accepted

Checking a locally stored string for tamper

What you want is something that ensures integrity of your data. The most common solution for this is to use an HMAC, that is a keyed digest. NodeJS has an API that calculates HMACs. Compared to a "...
user2313067's user avatar
4 votes

Authenticate a browser that has no user input (a kiosk) from another browser

Sounds like you need to authenticate the device, rather than a user. Also sounds like you have complete control over what is installed on the kiosk. I would approach this problem using client ...
John Wu's user avatar
  • 9,321
4 votes
Accepted

Recent ESLint hack or how can we protect ourselves from installing malicious npm packages?

Three words: Supply Chain Management. Except that in our case the "supply" is dependency or "third party libraries". This isn't a unique problem to npm. This a general problem in software ...
mroman's user avatar
  • 565
4 votes

Does it make sense to consider a triggerable server software crash a DOS attack?

Your attack is basically the definition of DOS, it literally denies service and you are using the term correctly. Consuming bandwidth is a naive approach that does not require the sever to have a ...
le3th4x0rbot's user avatar
  • 3,249
4 votes

Magic links: JWT vs random string

It's true that you can use a random string for the magic link and it'll work just fine. However there are a few benefits for choosing to implement it using JWTs: JWT validation doesn't require a call ...
AlphaD's user avatar
  • 943
4 votes

When to request refresh token? JWT

A few thoughts: Cookies aren't a great place to put refresh tokens at all, really. They're not the worst, but it's more common to use Local Storage and only ever transmit them when you're using them. ...
CBHacking's user avatar
  • 49.3k

Only top scored, non community-wiki answers of a minimum length are eligible