67
Resources are cached by their URL, and the protocol (http:// or https://) is part of the URL. Since the protocol differs, the URL must also differ, and you have two separate cache entries.
45
It is perfectly fine if a http:// and a https:// resource provide different data, even if everything but the access method is the same. For example access to http:// will today often result in a redirect response while access to https:// provide the real content. A browser will therefore cache these resources independent from each other.
41
The current general best practices for authentication are in the NIST SP 800-63-3 Digital Identity Guidelines standards, especially in SP-63B Authentication and Lifecycle Management.
These NIST standards are an easy read for developers, and besides telling you what to do, it also talks about why you want to do certain things. (If you want more details than ...
26
As a general rule, you should restrict user input as much as possible, but not more. A field designed to hold the name of towns don't need unrestricted length. But if you cap the length at 25 thinking no names can be longer, you will upset the Welsh.
Shorter input lengths means less space for payloads if you are worried about e.g. SQLi or XSS. It could ...
9
It depends on what you want to protect against.
You mentioned that you have a Regular Expression used to validate input. That can be good, but depends ultimately on how your regular expression is formed. If your RegEx looks like this, you'll likely be fine:
{\"name\":\"(.+?)\",\ ?\"age\":(\d+?)}
If your RegEx looks like this on the other hand...
({.+})
...
9
The salt isn't supposed to be secret. Its purpose is to be different for every password, so the hashed database can't be attacked with rainbow tables. The other parameters you mention aren't supposed to be secret either. So you can store all this information in the same database, which is how most applications do it. The database table that contain the ...
8
Summary:
The primary cache key for any standards-compliant browser is an absolute URI
The absolute URI begins http: for all insecure requests and https: for all secure requests
Consequently, a resource fetched securely can never use the same cache key as a resource fetched insecurely
The current standard for HTTP is split across multiple "RFC" documents, ...
7
This is not a cross-site script (XSS) attack. This is you editing the page inside your own browser to attack yourself. You can try to write down and publish the necessary instructions how each victim can attack itself but this is not cross-site and not even a real attack. This is more like telling someone how he can shoot himself.
5
Is there ANY way, an URL can run embedded JavaScript?
A URL cannot run anything. A URL is just a string. How an URL can be used or abused depends on the context and application where it is used.
Your specific case is about an XSS vulnerability in the web application where parts of the URL where embedded in the HTML page in a context which triggered the ...
5
I am not sure where you intend to place this login screen but I assume that you will rewrite part of the servers to add a login page. I do not really understand what is "the server" written in Python you are referring to.
Anyway, do not reinvent how to store the passwords. There are methods for that and since you mention Python, a good starting point may be ...
4
The custom HTTP header works as a defense in and of itself. Actually, one rudimentary form of CSRF protection is to simply set a custom header to a constant non secret value and then check for it server side. This protection is sometimes applied unknowingly by simply requireing certain content-type headers.
OWASP describes this technique:
Adding CSRF ...
4
It is a form of SSRF or CSRF (depending on how it is rendered), if it is not cached, it will need to fetch the image from the URLwhen viewed.
By setting the image URL to a URL the attacker control, they can possibly obtain the victim's source IP, referer URL and more from the request received to that URL.
4
This is a software engineer here. I will answer from that point of view.
My local network has many devices on it running simple web servers
You should really try to see if you can use SSO (Single Sign On).
Before telling some detail, SSO is basically not storing passwords in your app. You will rely on a third secure party, like Active Directory. After ...
4
There are a couple of obvious things which are not limited to image parsing libraries:
Don't assume that the input is well-formed but actually check it. It is actually a common problem with image or video libraries that they were not designed with deliberately malformed input in mind but which are nevertheless used to process input from dubious origins.
Use ...
3
There are two main ways to do this. One is to restrict the allowable origins of web requests, which will need to be done by IP filtering. The other is to require extra authentication - specifically, TLS mutual authentication - on your server, using a TLS client certificate that only Cloudflare has; this will cause any web request from a host that doesn't ...
3
TL;DR "System administrators can spot a headless request with ease": NO. They can surely spot some headless requests with ease. But in general, that's not true.
Quite obviously, it all depends on how the requests are done (how much effort to disguise them) and how the logs are checked and what countermeasures adopted (how much effort goes into penetrating ...
2
Using type="password" in HTML only prevents shoulder-surfing by obscuring the typed characters on the screen. The actual password is available to any code that can access the document object model, and, in the absence of a TLS connection, is sent to the server in the clear.
Although not directly related to the question, I have to add that "client-side ...
2
In Angular:
Routing guards not provide security, however this still depends on the way that the full-stack of your application is built, we still need to be careful and not allow the api/application to load authenticated data for unauthenticated users. For example, if you guard a route, let's call it my-account in this case, by saying that only ...
2
Unfortunately (for the attacker) this specific technique only applies to PHP 5.3 and below. It is likely that you are encountering a newer version considering the last release of PHP 5.3 was in August 2014.
Here's a bug listing for PHP and there are multiple articles and resources specifically mentioning the null byte bypass in LFI being restricted to ...
2
One idea I had is to add an Azure Firewall, and set it to white list the CloudFlare IP Addresses, but I wondered if there is an easier way (and anyway I am not sure how to configure it)
I'm afraid this is the only option: otherwise anyone could send a direct request to example.azurewebsites.net using your domain in the HTTP headers:
GET / HTTP/1.1
Host: ...
2
Leaving aside the fact that the spec is quite clear that different URLs should be treated as different resources, don't you think that someone might have noticed and exploited this by now if it were not the case? After all the issues exposed by cookies (and addressed by the "secure" flag) have been known about for 20 years or more.
So the browser must ...
2
Yes, because they are different network destinations. The tcp port is not shown in the location bar when using the standard port.
Http defaults to tcp port 80. Www.example.com:80
Https defaults to tcp port 443
Www.example.com:443
Even if the domain and ip are the same, the ports are not. From the browser perspective, the browser is communicating with ...
2
CBHacking's answer is completely accurate regarding the benefits of VPNs. However, I do not believe it addresses your question of "does allowing VPN access to mobile devices increase risk?"
You may have valid concerns. Depending on the type of mobile device, it may be a mobile phone that could be lost or stolen, or a industrial-type/other device that is ...
2
The main advantage of a VPN over a simple TLS connection (which HTTPS is) is that the VPN authenticates the client. TLS can do this as well; just use mutual TLS (TLS with client certificates), which nearly all TLS server and client
implementations (including HTTPS servers and clients) support. Create and install a unique client certificate (with a unique ...
2
One way to allow HTTP/HTTPS requests from Cloudflare's IP space, but block HTTP/HTTPS requests from all other IP's, without using an Azure Firewall, is to run a firewall on your VPS. This can be done using ufw. See https://www.linode.com/docs/security/firewalls/configure-firewall-with-ufw/ for a guide that will help you setup the necessary rules for what ...
2
You can't set those headers, because the browsers ignore attempts to set them. Browsers ignore attempts to set them, because they aren't supposed to be script-controlled. The restriction on letting them be script-controlled is for security reasons. If you could set the Origin header, you could break the security guarantees of CORS. Since the whole point of ...
2
So i wanted to know what are possible threats to my application if a
attacker is successful in finding out combination of 2 word that are
used for accessing item for a particular user.
Umm..isn't that obvious whatever another user can do with his 2 word combination,an attacker could do the same if he guessed the combination.If you are protecting ...
2
To expand on one point from Steffen's answer: whenever you have code that is consuming untrusted input and considered an exploitation risk - such as an image library consuming files from untrusted sources - you should look at sandboxing that code. There are a number of ways to do this, varying by things like language, OS, and CPU architecture, but here are ...
1
Your method is sufficient to deter most automated scanning attempts of this nature
They are most likely probing for weak plugins.
Your best bet is to minimize the use of plugins, and keep everything up-to-date automatically.
1
You should always ensure you understand what user input you expect and make sure the actual input is as close to what you expect as possible.
Data that is longer than expected can lead to many types of security problems:
DOS attacks / resource over-use: 1 GB wasted for a dummy name in a database, or CPU power wasted to regex-validate a 1GB name that ...
Only top voted, non community-wiki answers of a minimum length are eligible
