2
votes
Accepted
What are the security concerns of embedding Base64-encoded images into an HTML document?
From what you tell us, the most likely path of attack on your application is at the conversion from PNG/JPEG to WebP step.
If there is a vulnerability in whatever you use to do the conversion (which ...
- 4,295
2
votes
Accepted
Modifying request responses leading to unauthorized access?
This is a plain ol' run-of-the-mill Broken Access Control
Bypassing access control checks by modifying the URL...
This type of problem is #1 in OWASPs Top 10 list
Solution: Authentication and access ...
- 123k
1
vote
Should deprecated versions of TLS not be used
They most often have been deprecated because they are undeniably insecure, or might be insecure in some configuration. RFC 7568 and RFC 8989 explains in length why SSLv3, TLS 1.0 and 1.1 got ...
- 4,295
1
vote
Should deprecated versions of TLS not be used
It depends on the clients that you expect to be connecting to your server. If you are fairly sure that most/all of the clients will be modern up-to-date web browsers, then it's safe to enable only ...
- 19.5k
1
vote
Accepted
A few questions about fixation attack
(Is the explanation under "Attacker uses the app" your own understanding or something you found on the Internet? If the latter, the author didn't actually fully understand the attack or ...
- 3,807
1
vote
The ".htaccess" file can be downloaded. Why? How to fix?
To give an update on @eax's response, the rules protecting files beginning with .ht have slightly changed with Apache 2.4 to below:
# The following lines prevent .htaccess and .htpasswd files from ...
- 1,102
Only top scored, non community-wiki answers of a minimum length are eligible