New answers tagged web-application
0
votes
Accepted
Is Using an Authenticator App on the Same Device as the Passwordless Application a True 2FA?
If you're using a magic link via email, then you can actually probably just continue using that in place of the MFA verification. You're already using an external service to authenticate, so why ...
0
votes
Is it necessary to implement both Content-Security-Policy and X-Content-Type-Options for ensuring the security of a website?
Both headers are defense-in-depth type headers, so "neccessary" might be a bit strong.
But both headers do have a purpose, and they do not overlap. The two problems I can think of:
CSP ...
- 29.5k
2
votes
Accepted
Does Firebase App Check provide CSRF protection?
Based on the available documentation, no, it probably does not. Specifically, there is no indication that the App Check token is tied to a specific user, only to a specific app; another user of the ...
- 46.3k
1
vote
Login/Registration: why is not telling the users they got their username wrong during login, if registration already hint username existence?
The way to mitigate that would be to not give away this information during the registration process, but when your registration form is only email + password, you can not really do that ?
If you're ...
- 9,212
1
vote
What happens if a DNS record points to non-controlled IP address?
Multiple failures will probably occur, preventing much from happening.
Many sites are behind reverse proxies (e.g. CloudFlare) or other virtual host setups that rely on looking up the backend server ...
- 12.7k
0
votes
How to prevent directory traversal when joining paths in node.js?
Another option:
You can just join twice.
path1 = "public/html" // Hardcoded path.
path2 = req.query.path // Untrusted user input.
const normalized = path.join('/...
- 101
Top 50 recent answers are included