2
votes
Accepted
Does Firebase App Check provide CSRF protection?
Based on the available documentation, no, it probably does not. Specifically, there is no indication that the App Check token is tied to a specific user, only to a specific app; another user of the ...
1
vote
Accepted
Risk of using scripting language on backend?
The main risk of scripting languages is that they usually have constructs to execute a string as code, i.e. things like eval. This can be used for injections attacks if this feature is used in the ...
1
vote
Login/Registration: why is not telling the users they got their username wrong during login, if registration already hint username existence?
The way to mitigate that would be to not give away this information during the registration process, but when your registration form is only email + password, you can not really do that ?
If you're ...
Only top scored, non community-wiki answers of a minimum length are eligible
Related Tags
web-application × 3366authentication × 418
appsec × 350
xss × 296
web-browser × 242
php × 212
javascript × 212
encryption × 194
penetration-test × 190
tls × 177
webserver × 177
csrf × 163
http × 152
passwords × 151
sql-injection × 127
cookies × 126
attacks × 115
session-management × 105
vulnerability × 100
databases × 83
attack-prevention × 75
web-service × 73
network × 66
privacy × 64
cryptography × 60