2 votes
Accepted

What are the security concerns of embedding Base64-encoded images into an HTML document?

From what you tell us, the most likely path of attack on your application is at the conversion from PNG/JPEG to WebP step. If there is a vulnerability in whatever you use to do the conversion (which ...
user avatar
  • 4,295
2 votes
Accepted

Modifying request responses leading to unauthorized access?

This is a plain ol' run-of-the-mill Broken Access Control Bypassing access control checks by modifying the URL... This type of problem is #1 in OWASPs Top 10 list Solution: Authentication and access ...
user avatar
  • 123k
1 vote

Should deprecated versions of TLS not be used

They most often have been deprecated because they are undeniably insecure, or might be insecure in some configuration. RFC 7568 and RFC 8989 explains in length why SSLv3, TLS 1.0 and 1.1 got ...
user avatar
  • 4,295
1 vote

Should deprecated versions of TLS not be used

It depends on the clients that you expect to be connecting to your server. If you are fairly sure that most/all of the clients will be modern up-to-date web browsers, then it's safe to enable only ...
user avatar
  • 19.5k
1 vote
Accepted

A few questions about fixation attack

(Is the explanation under "Attacker uses the app" your own understanding or something you found on the Internet? If the latter, the author didn't actually fully understand the attack or ...
user avatar
  • 3,807
1 vote

The ".htaccess" file can be downloaded. Why? How to fix?

To give an update on @eax's response, the rules protecting files beginning with .ht have slightly changed with Apache 2.4 to below: # The following lines prevent .htaccess and .htpasswd files from ...
user avatar
  • 1,102

Only top scored, non community-wiki answers of a minimum length are eligible