Hot answers tagged

10

Public key: that's the easy part, it can be almost anywhere (known URL, some type of file store like S3/GCS/..., even source control). The only concern is to make sure it is not modified, but it can be read by anyone. Private key: this is where it gets tricky. The private key should be as safe as possible with access as limited as possible. If someone reads ...


3

One option to add to Marc's answer would be a hardware security module (HSM). These are expensive and not always practical (cloud providers may offer HSM-backed key storage but you can't just attach your own HSM). However, they can be made more secure than a key file. The HSM need not ever divulge the key; instead, when some program (your server) wants to ...


3

Timing attacks are possible even if response times seem inconsistent, because you can use statistical analysis to filter out a lot of noise in the data. Average values are much more stable than instantaneous values, for example. A fixed delay (like the one introduced by the comparison) will be added to the average, while inconsistent delays (like the ones ...


2

The Cipher-Block-Chaining Mode becomes problematic if your threat model includes an attacker who actively manipulates the encrypted data. This allows an attacker to flip specific bits in the cipher to flip the same bits in the resulting plaintext - a property called malleability. If not paired with a MAC to ensure integrity, CBC is not very secure. When ...


2

The certificate (which is sent from the server to the client) contains the public key (along with necessary information for the recipient to verify the key's authenticity). The other file (created by the genpkey operation) contains the private key (and enough information to produce the public key), and is never sent anywhere. Run man genpkey to see more ...


2

Heroku does not support client-side certificate validation to its Postgres databases unless you are using Private Spaces or Shield: Unless you're using a Private or Shield Heroku Postgres database, Heroku Postgres does not currently support verifiable certificates. My understanding is that in this case, the best you can do is: Your connection is ...


2

There are multiple things at play here. Let's tackle them one-by-one and then answer your questions. JWTs are Bearer tokens. If someone has the token, he wields any powers associated with it. Moreover, JWTs are also self-describing. They are meaningful without external data (valid or invalid, based on the signature and time)*. This makes them easy to use ...


1

If you lose controle over your javascript files. Anything can be done with them. If you load the files inside your node application (Ea import them or eval them or such) So A important question is why are you serving code from a different location outside of your controle? Would it. It be better to serve data files from s3 and serve code from your own ...


1

This format is used by a kind of HTTP proxy. Unless your server is actually misconfigured or hacked to be used as a proxy (you should get rid of the browser limitation and test it out), it may have the following possibilities: Someone is scanning a wide range of IP addresses for open proxies. Someone is testing the availability of an open proxy once existed ...


1

There are likely many tools and custom scripts out there that accomplish what you are trying to do. However, I think fail2ban is a good example. It ships with profiles "apache-badbots", "apache-noscript", and others that that will follow your logs and temporarily ban anyone who is in violation of the rules, e.g. trying to access .php pages on a NodeJS server....


1

you cannot, you have make another request to backend from there you can remove the cookies.


1

Use environment variables as you said, just be careful in how you actually pass the value to the variable so that it doesn't leak to logs. For example, instead of docker run -e SECRET=foo, use docker run -e SECRET=$(cat my_secret).


Only top voted, non community-wiki answers of a minimum length are eligible