New answers tagged web-application
0
There has always been a debate between Convenience and Security. Ans its good to have inconvenience instead of getting the systems/application.
The purpose of two-factor authentication is to double-check the legitimacy of the user, and if we save one of the parameters, I think it is as good as not using it.
Two-factor authentication is a must for ...
3
No, they are not the same.
What does certbot do?
certbot is a program by Let's Encrypt, which automates the certification process. The command you posted generates a certificate signing request (CSR) for the domains your_domain and www.your_domain. The servers of Let's Encrypt then try to contact your instance of certbot via those domains. If successful, ...
0
OWASP recommends to lock down unused routes in the way described in the question.
Restrict HTTP methods
Apply a whitelist of permitted HTTP Methods e.g. GET, POST, PUT.
Reject all requests not matching the whitelist with HTTP response code 405 Method not allowed.
Make sure the caller is authorised to
use the incoming HTTP method on the ...
1
Generally, the ISO standards establish a process that will yield secure systems rather than definitively telling you how to build or configure a secure system. They are a helpful foundation in that sense, but they may not provide a specific answer.
Risk assessment is a shared responsibility between all stakeholders. The designer (your firm), the data ...
0
I can imagine a few good use cases for this. For example, a web page like https://coinb.in/#newAddress, which lets the user create a new bitcoin address, along with the corresponding private key, using client-side javascript-based crypto running in the web browser.
This is a handy tool, and there is no reason why this page should not be static. But how ...
1
If a page has a link that window.history.back(), it may be open to attacks that abuse the trust a user places in the links within the web application. A form of open redirect is possible. When a user visits an attacker's site that redirects to the web application, the back link will end up on the attacker's site, which can present a phishing page.
So the ...
2
In this specific case, I would recommend against remembering 2FA. Most of your users will probably ask the browser to save their login and password, so saving the 2FA state will remove a safety barrier.
If someone loses his device (stolen or forgotten somewhere), there's nothing to stop anyone to just log back in and download everything. If you enforce a ...
3
Is it possible?
Yes, in theory, it is possible to define a checksum for the index page of a website. If browser vendors wanted to support such a thing, it could definitely be done. Similar mechanisms for SRI and CSP already exist.
However...
It doesn't make any sense. /index.html pages used to be integral parts of the web, back when it was mostly static. ...
1
Most definitely!
File uploads can be very tricky and there is a lot that can go wrong. There are (at least) two further steps you should take:
1. Verify that the file is actually a PNG
If you are expecting only PNGs, then you should verify that the file is actually a PNG. To be clear, checking the extension is useless here - you want to check the actual ...
1
The problem isn't that there are known security vulnerabilities.
The problem is that there is not really an effort to address less common but critical vulnerabilities.
For example, many web servers will display error messages. Until quite recently, Apache Httpd would include some of the request data in the error pages, which allowed cross-site scripting ...
0
Another advantage of session tokens is that each client gets a unique one, and the user can see what sessions are active and what they're doing. This means they can do things like end a mobile app's session without needing to end all the other sessions. This requires the ability to revoke tokens, of course (not necessarily possible with JWTs, but you can ...
0
Based on OWASP REST Security Cheat Sheet https://owasp.org/www-project-cheat-sheets/cheatsheets/REST_Security_Cheat_Sheet
In GET requests sensitive data should be transferred in an HTTP
Header.
1
If you want arbitrary people, who you cannot predict or define ahead of time, to access the page, then it needs to be unrestricted. If you don't want search engines from indexing the data, then you need to block automated processes from accessing it. CAPTCHA is a standard method for doing that.
But that still means that any human visitor to your site could ...
1
You need to be able to distinguish between the trusted client and the untrusted third party in order to block the third party. This means that you somehow need to find out when the trusted client connected and when the connection does not come from the trusted client. This means you need some form of authentication but it does not need to be some setup with ...
1
Yes, you can..
Assuming you know the table name and union is not blocked, you can dump that table's data.
MariaDB [security]> select `2` from (select 1,2,3 union select * from user)a;
This will dump the second column's data. What happens is that when we first select 1,2,3 before selecting the columns from the table the name of the columns is changed ...
0
To solve this issue you need to modify this line:
myuser ALL=(root) NOPASSWD:/myuser/program.pl,/usr/bin/perl
Into this one:
myuser ALL=(root) NOPASSWD:/usr/bin/perl /myuser/program.pl
-3
Clear SSL Certificate Cache:
Press Windows + R type “inetcpl.cpl” and click ok. This will open Internet Properties.
Switch to the Content tab, then click on Clear SSL state
Now click Apply followed by OK.
Reboot your PC to take effect the changes,
Now open chrome browser and check there is no more errors.
https://geeksadvice.com/fix-net-err-cert-date-...
1
I think this depends on the HTTP library that handles the requests, for example, in theory if the content of a POST message is json and the content-type is set to text/html the responsibility of give an error will be from the application (the content ins not text and is json), however depending on the HTTP library this check can be done on the HTTP library, ...
1
Let us try to answer the questions one at a time:
Is it correct that putting user passwords ..., while web applications do? Does HTTP know to look for user names and passwords or for other specifics in message bodies?
At the HTTP level, the body is an opaque stream of bytes. But it is common to use HTML form answers to give passwords for form ...
3
PDF in browsers
Assuming the browser makes things safe for you, you shouldn't have anything to do on your end (more or less). Unless you are yourself implementing a browser.
One thing I've seen, though, are processors that will remove scripts from such file formats (especially in MS-Word/Execl files). Then you know that at least they won't execute anything ...
0
Open up the developer tools on your browser next time you visit a site - even sites not deriving their income from targeted advertising will be accessing resources on public repositories, calling analytics and doing other thngs than just accessing the site you typed in the URL.
3
A Web Server handles certificates and TLS connections
A web site itself is simply an HTML document, possibly including scripts and stylesheets, and references to other resources (external scripts, styles, images, etc.). The document itself is not aware if it is served via HTTP or HTTPS, and if so, which certificate was used for that.
Instead, these things ...
0
The problem is that cookies are browser-wide. So if some script sends a request to a website the session cookies get sent.
If you want to sandbox the websites this would have to mean that cookies are now only for one sandbox and would require that the user explicitly selects a sandbox. Firefox actually has something similar now. It's called containers but ...
0
Answer : If you store the token in the localStorage and append it to your requests with JS, it would automatically guarantee CSRF protection (by the nature of the attack)
Addendum :
As of whether it is more safe to use http-only cookies rather than localStorage (making it seem like this way of having CSRF protection would create a problem in case of XSS) : ...
0
The remote API may be designed this way, so any other http methods except GET or POST are not used, for example:
DELETE /item/123
may be:
GET /delete/item/123
Anyway, you will have to read an API spec and figure out how to add or delete items, so it's 50/50 argument that one is better than another. I prefer having only GET and POST.
3
It's not enough. One possible bypass:
</textarea ><script>alert(1)</script>
This works because of the extra space after textarea.
You could adapt your filter to catch this as well. But I wouldn't recommend it because the approach is already flawed.
If you do not need to allow a user-supplied subset of HTML to be rendered (which isn't ...
0
While it's OK, ideally you would include the userid in a claim of the jwt token.
That's easier said than done. If it's your own service that includes libraries for jwt and issues the tokens only for your own service, then you could add the claim.
If your system uses an external standalone Oidc system that's shared by multiple systems, you would need to ...
2
I can't tell if you independently re-invented double-submit cookies and didn't think anybody'd thought of it before, or just didn't do any research on a well-known topic. https://duckduckgo.com/?q=double+submit+cookie+weakness&ia=web has no lack of results, including some from this very site (see Double Submit Cookies vulnerabilities and Is the double ...
2
It seems to me that what you are proposing does not violate the normal workflow. You are making a request from the asserting party (site1 or site2, AP) to the service provider (auth-SP) which in turn is making a request to the identify provider (IdP).
It is also fairly common to implement this approach when a site accepts credit cards but doesn't want to ...
0
From the comments:
Store a second column with the hash of the email. When a user submits their email and password, hash the input email and look it up in the db. This will mitigate timing attacks to the point where it is insignificant.
How hashing mitigates timing attacks is discussed on the below post:
https://stackoverflow.com/a/27029501/7886229
Top 50 recent answers are included
