New answers tagged

0 votes
Accepted

Is Using an Authenticator App on the Same Device as the Passwordless Application a True 2FA?

If you're using a magic link via email, then you can actually probably just continue using that in place of the MFA verification. You're already using an external service to authenticate, so why ...
Robert Babaev's user avatar
0 votes

Is it necessary to implement both Content-Security-Policy and X-Content-Type-Options for ensuring the security of a website?

Both headers are defense-in-depth type headers, so "neccessary" might be a bit strong. But both headers do have a purpose, and they do not overlap. The two problems I can think of: CSP ...
tim's user avatar
  • 29.5k
2 votes
Accepted

Does Firebase App Check provide CSRF protection?

Based on the available documentation, no, it probably does not. Specifically, there is no indication that the App Check token is tied to a specific user, only to a specific app; another user of the ...
CBHacking's user avatar
  • 46.3k
1 vote

Login/Registration: why is not telling the users they got their username wrong during login, if registration already hint username existence?

The way to mitigate that would be to not give away this information during the registration process, but when your registration form is only email + password, you can not really do that ? If you're ...
Gh0stFish's user avatar
  • 9,212
1 vote

What happens if a DNS record points to non-controlled IP address?

Multiple failures will probably occur, preventing much from happening. Many sites are behind reverse proxies (e.g. CloudFlare) or other virtual host setups that rely on looking up the backend server ...
multithr3at3d's user avatar
0 votes

How to prevent directory traversal when joining paths in node.js?

Another option: You can just join twice. path1 = "public/html" // Hardcoded path. path2 = req.query.path // Untrusted user input. const normalized = path.join('/...
Rokt33r's user avatar
  • 101

Top 50 recent answers are included