New answers tagged web-application
0
Q: Is Link Obscurity as a Security Practice Bad?
A: No, it is not bad provided obscurity is used with other security measures.
Link obscurity is an example of security-via-obscurity which is always bad when implemented as the only protection mechanism but is perfectly valid when used in conjunction with other security measures.
1
For training purposes you can take some VMs at some cloud provider, organize them into an internal network, so that the whole traffic remains within this network. Then you can do there whatever you want within this network. If you need it repeatedly, take tools like Terraform, so that every time after executing the scripts you get identical environment. ...
3
Is there any advantage in using HTTP with an encrypted message instead of HTTPS?
No, and I can list a handful of disadvantages:
It's not properly tested and vetted
Homegrown code usually lacks quality
It creates a huge point of failure because the developer is not a cryptographer
It's not easily updated with better algorithms
It's not secure
It performs ...
1
It depends on what the custom algorithm is. If it is a home made one, it is an evidence of poor security practices. The rule for crypto is don't roll your own, except for experts and experts know that a new thing can only be used in production after extensive reviews.
That being said, there can be use cases for development teams. It is common for medium to ...
1
I would say using headers is marginally more secure than a meta tag because:
Some CSP elements such as report-to/report-uri are not supported in meta tags (see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/report-to for that specific example and following the comment from Fire Quacker, this more general guidance https://...
4
its never inserted into the DOM as the object is stored on the sever side of the application
Well, that answers your top-level question: it's impossible to have XSS if the content isn't sent to the client, because it's a client-side attack.
Now, with that said, since your server is apparently processing JSON containing user content, you do need to worry ...
1
There is a lot to unpack here, and so I will do my best you give you a fair and accurate response while keeping this relatively brief. Firstly, I don't think that your echo_html_comment() XSS sanitizer is effective but, rather, I think that you have defined it in such a way as to have an effective sanitizer. When you say that "I consider character ...
0
Besides the points made in other answers, you should check if the exif data of the photos you're uploading have any identifying information (geotags, names, etc). This can be done using exiftool.
As for the security risks of photo uploading, that's more of a risk to the host server than to you (as someone could upload a reverse shell).
Top 50 recent answers are included