User DannyNiu

2 votes

1 answer

409 views

Should I check Host header or ServerName for CSRF defense when serving behind proxies?

asked Oct 28, 2020 at 7:48

2 votes

1 answer

343 views

Is CVE-2023-24055 applicable to other password managers using the same format as the original KeePass?

asked Feb 8, 2023 at 1:39

0 votes

1 answer

196 views

WebAuthn does not guarantee public-key integrity other than trough attestation?

asked Aug 12, 2023 at 15:16

0 votes

0 answers

84 views

Security implication of loading untrusted private keys

asked Sep 25, 2023 at 4:23

0 votes

1 answer

142 views

Will sky fall if I don't verify `AuthenticatorAttestationResponse`?

asked Feb 27 at 9:20

0 votes

1 answer

73 views

Suggestions for implementing a simplified subset of WebAuthn Relaying Party Operation

asked Feb 28 at 1:36

0 votes

2 answers

199 views

How does it "allow a malicious website to obtain valid credentials." - WebAuthn

asked Feb 28 at 8:52

0 votes

0 answers

128 views

Additional verification, sanitization for transcoded CJK paths in URLs

asked May 28, 2021 at 10:25

0 votes

1 answer

3k views

Array in HTTP GET/POST requests

asked Feb 22, 2018 at 2:29

0 votes

1 answer

805 views

Storing server-side secret key in environment variable - is a concern?

asked May 22, 2019 at 9:12

0 votes

1 answer

2k views

Clarification of relationship between CORS and CSRF [closed]

asked Dec 5, 2019 at 11:28

Stack Exchange Network

11 Questions

Should I check Host header or ServerName for CSRF defense when serving behind proxies?

Is CVE-2023-24055 applicable to other password managers using the same format as the original KeePass?

WebAuthn does not guarantee public-key integrity other than trough attestation?

Security implication of loading untrusted private keys

Will sky fall if I don't verify `AuthenticatorAttestationResponse`?

Suggestions for implementing a simplified subset of WebAuthn Relaying Party Operation

How does it "allow a malicious website to obtain valid credentials." - WebAuthn

Additional verification, sanitization for transcoded CJK paths in URLs

Array in HTTP GET/POST requests

Storing server-side secret key in environment variable - is a concern?

Clarification of relationship between CORS and CSRF [closed]