New answers tagged

0

The loaded page can contain some code that periodically polls data from the web site. This doesn't need to be a secret function. It can be a pretty normal one, e.g. the web site checks if there are any new messages on the server, e.g. it displays the online status of your friends. On each such request the server sees your current IP. If the loaded web page ...


2

When you enable/disable a VPN your IP address changes but your browser doesn't. A web application can easily track you regardless of your IP address by using cookies and a variety of other methods. In fact, the IP address doesn't matter at all for tracking purposes - a user on a mobile phone will have their IP address change frequently by simply walking out ...


2

1. How to properly accept and store a new document. I would recommend to store files in the database, not separately. A) File system is not transactional. That's why it is hard to keep it consistent with database. B) Creating of backups and restoring of particular versions from backups can lead to inconsistencies between file system and database: Database ...


3

A Web Server handles certificates and TLS connections A web site itself is simply an HTML document, possibly including scripts and stylesheets, and references to other resources (external scripts, styles, images, etc.). The document itself is not aware if it is served via HTTP or HTTPS, and if so, which certificate was used for that. Instead, these things ...


2

Quite a bit of security requires obscurity. I.e., don't share your private keys. HOWEVER, the point of the near-universal hatred of "security through obscurity" is that, too often, people rely only on one layer of obscurity, and do not realize just how easy it is to guess. Cloudflare provides some security by providing a bit of indirect obscurity. When ...


4

Yes. The idea is that you block all HTTP and HTTPS connections to your server, except those originating from Cloudflare's network. Therefore, your server cannot be attacked directly - all HTTP and HTTPS requests must go through Cloudflare's web application firewall (WAF) first, before reaching your server; and Cloudflare's WAF will block any suspicious ...


5

Let's suppose that the site allows uploads without protection and I am able to upload a PHP shell. I access the shell, which gives me terminal access. At this point, I am running commands on the operating system as www-data or whatever user the site is configured to run as. Now I can hunt around for configuration files that might have root passwords in it ...


0

If you are providing a public API already, the security concern should be focused with the server side endpoints and not the client. Yes, providing a public client to your API will allow any one to investigate your API, but anyone can already do that. The API will just make it easier to determine what endpoints exist and how they are used. If you are ...


-1

If your server is online, and has port open with no whitelist, it can be brought down with DDoS. Simple.


Top 50 recent answers are included