User bobince

8 votes

Accepted

Is a forced rewrite from http to https secure? What does SSLRequireSSL add?

answered Oct 19, 2012 at 11:41

3 votes

PCI-DSS Scope with tokenisation

answered Oct 9, 2012 at 12:43

5 votes

How can I prevent reflected XSS in my JSON web services?

answered Sep 20, 2012 at 9:07

3 votes

Accepted

How to prevent the following clickjacking attack?

answered Sep 13, 2012 at 23:12

0 votes

Is not checking the src url a vulnerability?

answered Aug 30, 2012 at 15:53

33 votes

Accepted

Convince the company not to store credit card numbers in our webapp

answered Aug 15, 2012 at 22:20

19 votes

Accepted

When registering for most websites, why do you need to confirm your email address?

answered Aug 15, 2012 at 21:52

21 votes

Is it standard practice to ask a customer to send a photo of their credit card to confirm their identity?

answered Aug 8, 2012 at 8:51

5 votes

Accepted

How does a trojan like Trojan:JS/BlacoleRef.BV infect a website?

answered Jul 14, 2012 at 11:04

6 votes

Malicious Script

answered Jun 28, 2012 at 18:24

5 votes

Accepted

Risks of serving untrusted content under HTTP Content-Type: text/plain?

answered Jun 22, 2012 at 8:30

2 votes

Mass account lockout prevention using CSRF tokens

answered Jun 19, 2012 at 11:53

17 votes

Accepted

Why doesn't the same origin policy block get requests that contain arguments?

answered Jun 19, 2012 at 8:11

5 votes

Does setting the cookie-path protect me from XSS from another context?

answered Jun 12, 2012 at 10:01

16 votes

Why is passing the session id as url parameter insecure?

answered Apr 24, 2012 at 13:33

5 votes

Are Three attempts to block login a good idea?

answered Mar 30, 2012 at 13:29

3 votes

Does X-Content-Type-Options really prevent content sniffing attacks?

answered Mar 20, 2012 at 12:38

4 votes

Accepted

Why the servers stores hashed password instead of relaying on private/public key

answered Mar 17, 2012 at 14:56

2 votes

Why did secureserver.net (GoDaddy) access my Gmail account?

answered Mar 12, 2012 at 8:57

4 votes

Accepted

What servers or clients are immune to related-domain cookie attacks? (*.example.com)

answered Mar 7, 2012 at 10:04

5 votes

Accepted

Has my Mac been compromised?

answered Feb 27, 2012 at 8:59

1 vote

Accepted

Removing Google Analytics cookie string from URL - security hole?

answered Feb 16, 2012 at 13:25

4 votes

Accepted

Can a CSRF CAPTCHA be defeated?

answered Feb 16, 2012 at 0:17

1 vote

sha512 as no-login-necessary token

answered Feb 6, 2012 at 8:04

20 votes

Accepted

Exploits or other security risks with SVG upload?

answered Feb 4, 2012 at 20:20

3 votes

Accepted

Should I prevent user from operating with site during some first seconds?

answered Feb 4, 2012 at 22:17

3 votes

Accepted

What due diligence is required for HTTPModules that run within IIS?

answered Jan 31, 2012 at 17:29

9 votes

Clickjacking: can't browsers just forbid/reject placing transparent elements over frames?

answered Jan 30, 2012 at 8:01

6 votes

Accepted

Is this JSON encoding vulnerable to CDATA injection?

answered Jan 26, 2012 at 22:29

3 votes

Will htmlspecialchars (php) be enough for making secure PDF files with user entered data?

answered Jan 21, 2012 at 16:11

Stack Exchange Network

159 Answers

Is a forced rewrite from http to https secure? What does SSLRequireSSL add?

PCI-DSS Scope with tokenisation

How can I prevent reflected XSS in my JSON web services?

How to prevent the following clickjacking attack?

Is not checking the src url a vulnerability?

Convince the company not to store credit card numbers in our webapp

When registering for most websites, why do you need to confirm your email address?

Is it standard practice to ask a customer to send a photo of their credit card to confirm their identity?

How does a trojan like Trojan:JS/BlacoleRef.BV infect a website?

Malicious Script

Risks of serving untrusted content under HTTP Content-Type: text/plain?

Mass account lockout prevention using CSRF tokens

Why doesn't the same origin policy block get requests that contain arguments?

Does setting the cookie-path protect me from XSS from another context?

Why is passing the session id as url parameter insecure?

Are Three attempts to block login a good idea?

Does X-Content-Type-Options really prevent content sniffing attacks?

Why the servers stores hashed password instead of relaying on private/public key

Why did secureserver.net (GoDaddy) access my Gmail account?

What servers or clients are immune to related-domain cookie attacks? (*.example.com)

Has my Mac been compromised?

Removing Google Analytics cookie string from URL - security hole?

Can a CSRF CAPTCHA be defeated?

sha512 as no-login-necessary token

Exploits or other security risks with SVG upload?

Should I prevent user from operating with site during some first seconds?

What due diligence is required for HTTPModules that run within IIS?

Clickjacking: can't browsers just forbid/reject placing transparent elements over frames?

Is this JSON encoding vulnerable to CDATA injection?

Will htmlspecialchars (php) be enough for making secure PDF files with user entered data?