Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [security]

Computer security is security applied to computing devices such as computers and smartphones, as well as to both private and public computer networks, including the whole Internet.

1
vote
0answers
19 views

SSO login & authenticate Wordpress users with JWT token

I'm in the midst of exploring SSO with JWT & Wordpress, I'm not too sure if it's a good practice or does this setup/flow have any security vulnerabilities. Currently JWT/SSO method i'm using is ...
13
votes
1answer
170 views

Security audit of open-source, RSA Blind Signature library

I've just published a small library implementing the RSA Blind Signature process. Here's the GitHub repo! I needed something portable, and easy enough to use that I could ask other people to ...
2
votes
0answers
18 views

WordPress rest api basic auth with IP check

I'd like to use basic auth with the WordPress API, but restrict the capability to a single IP address. I've updated the existing code from here: https://github.com/WP-API/Basic-Auth accordingly. It ...
1
vote
1answer
82 views

employing AES algorithm in Java

I have employed an AES algorithm in order to encrypt files within a GUI. I was wondering if my algorithm is secure. Could I change anything to improve it? Is my IV secure and is it producing different ...
12
votes
3answers
2k views

Python password manager

I am writing a python password manager, and I know there's a lot of scrutiny that goes into storing passwords (don't worry, mine aren't plaintext). I was hoping that this community could help me ...
2
votes
0answers
35 views

Custom Security for API access from server to mobile application

i am not the best at security but need a custom way to securely store personal identifiable information like name, address etc - Can i please have some feedback on this custom code, from my ...
10
votes
2answers
2k views

Employing 3DES algorithm in Java: is my code secure?

I am making a project just for fun that employs the 3DES algorithm in Java. I was wondering if my algorithm looks secure. Is there any advice or feedback you could give me? Do I need to include an IV? ...
4
votes
1answer
110 views

Secure session handling in PHP

I tried to search and read for 10-12 hours on how to have a secure session, and this is the (simplified version of the) code that I came up with. (found no good book or article with complete guide ...
3
votes
3answers
84 views

httprequest to php login system

I'm trying to make a login system for my website which I'll be releasing in public later on. I have inserted some main samples of my code in here and I would like some useful advise or suggestions. ...
3
votes
0answers
32 views

Django authentication against Exchange server

I wrote an authentication app for Django and my worry is primarily about the security of my app. My Django authentication app uses exchangelib to authenticate ...
0
votes
1answer
38 views

Delete directory tree function

I made this function to delete a directory with all its contents recursively, will it work as expected in a production environment ? is it safe ? I don't want to wake up one day with ...
2
votes
1answer
31 views

Encrypts using AES GCM for data with limited visibility and long rest

This is the third iteration of my venture on creating an encryption/decryption solution. I asked a question here, which led to this question here, which led to this answer here, which led me to ...
2
votes
1answer
56 views

Store a hash in a cookie to identify the user's account to keep logged in after close browser

I made a option to user choose to stay logged in even after he closes the browser. It's really simple to implement, but i'm not sure about the hash i used to identify the user that is stored in a ...
1
vote
1answer
81 views

RSA wrapper written in Kotlin

I've written up a small wrapper for RSA and AES encryption in Kotlin, and I want to make sure I'm not making any glaring mistakes before use it. This is going on a small project with basically no ...
4
votes
2answers
65 views

Database Model Security For Book Inventory

This code is one of the models developed for the Book Inventory application that is open for review. It is also based on a comment on this answer to a C# question. Based on the comment I did some ...
2
votes
1answer
90 views

C# Login Form, Login Button , security

So, I am new to VS and C#, I am self-teaching to get a better understanding of the back-end of the product I work with. I have created a small database with some information and a Login form. ...
2
votes
1answer
35 views

Wipe sensitive information from memory in Python

I have come up with the following method to remove sensitive information with the help of the garbage collector: ...
2
votes
1answer
39 views

AES CTR mode encryption with HMAC

I am trying to implement AES CTR encryption mode with HMAC authentication for messages. It's encrypting and decrypting fine as long as the key length is 64 bytes, since AES key and HMAC key are ...
2
votes
1answer
49 views

Effective & Secure Method to populate Access Token for authorization header in Rest Template

I am trying to consume a REST endpoint by using the RestTemplate Library provided by the spring framework. The endpoint also demands a Bearer Access Token as its authorization header, which is only ...
3
votes
1answer
92 views

Is it enough for PHP secure session class?

I need you help with my php session class. I can not understand, the class implements adequate work with sessions. By adequate work, I understand the security and correctness of the methods. ...
3
votes
2answers
72 views

PHP Secure Login Scripts

I have created this login script for a website I'm making; basically I want to make it as secure as possible, but also I want it to keep users logged in for 30 minutes. For example if I've logged in ...
2
votes
0answers
45 views

Python RSA/DSA File Cryptography, Key Generation, Key Protection

I have forked a previous version of my script, critiqued here: Generate public/private keys, encrypt, decrypt, sign, verify This program allows you to encrypt and decrypt raw files using RSA keys ...
5
votes
1answer
60 views

Simple bash script creates apache2 virtualhost config for subdomain

Simple bash script to create apache2 virtualhost for localhost. Can be used for public subdomains on developer server with changes - "replace .localhost". Tested on Ubuntu, but should work where ...
0
votes
0answers
58 views

Sandboxing untrusted JavaScript execution by redeclaring variables

Suppose, via AJAX, I downloaded a string jsCode containing JavaScript code from a (potentially malicious) third-party website. I want to allow the code to implement ...
7
votes
2answers
721 views

Reading source code and extracting json from a url

I made a program to read the source code from a url. To reach this url I need to specify a token. After read the source code, I extract a url in json format, andIi ...
5
votes
2answers
70 views

PHP password-resetting page

I am producing a PHP code and I want to implement it in my server to do its function. My question is, are there any vulnerabilities that I should correct? I tried to establish the session first then ...
2
votes
0answers
61 views

Python/Django Class based saving

I'm creating multiple Django apps with vote possibilities, so I made an app vote to handle all this votes. In my templates I'm including an ajax-function named <...
3
votes
1answer
336 views

Upload a user's avatar

Could you guys tell me if my code is safe? And i want to know how to improve it. You will see a detailed explanation about the code on the comment blocks inside the code. profileIMGform.php <...
3
votes
2answers
94 views

PHP login system with prevention for session hijacking, fixation, injection, etc

I'm creating a login system and I have been reading a lot about the security measures needed to prevent session hijacking, fixation, and injection attacks, etc. These two Stack Overflow posts were ...
3
votes
1answer
47 views

PHP remote upload security

I need to upload images to a remote HTTP server from a local script. The image name format is {32-char MD5}.jpg. Server directory format is ...
3
votes
1answer
59 views

Queries to print out on the screen a list of menus

For common users I have 10 queries and for registered users I have 30 queries like this one below, only to print out on the screen the link for the querystrings, a guy said to me that I should escape ...
3
votes
1answer
113 views

Enhancing PHP realpath($path);

PHP realpath($path); is insufficient for some cases since it returns false on paths that dont exist on a file system. I need a function that extends realpath($path); to return even path that does not ...
2
votes
1answer
188 views

Notification system using PHP+jQuery+Ajax

I have this code to display a counter on the side of <i class="fas fa-bell mr-3"></i>. I want to know if this code is good on security and perfomance. ...
2
votes
1answer
169 views

Login system with password reset sent to e-mail using PHP and PDO

I really like to use PDO because it's simple and easy to make a safe query, i prepared all queries and used placeholders, i think it's safe but i'm not sure at all, and I'm thinking if i used ...
3
votes
2answers
363 views

Simple one time pad cipher

I had this idea not to long ago on creating a secure chat for people who need to be not meddled with when talking (like whistleblowers, hackers, etc) talking to one of my friends about it he said I ...
3
votes
1answer
280 views

Uploading and showing images securely

I've read various posts about how letting users to upload files can create vulnerabilities to your website such as a user injecting PHP code in an image. So I've created a small test project where ...
10
votes
1answer
386 views

XTEA Block Cipher

Usually people recommend to never implement cryptographic algorithms yourself unless you are an expert in the field. This of course makes a lot of sense mainly because there are numerous things that ...
4
votes
2answers
49 views

CGI for htpasswd registration

I decided to go with a very simple CGI user registration program to pair with Apache's mod_auth_form wrapper around a private site. It was only just after I ...
5
votes
0answers
160 views

Secure Password and Passphrase Generator in Python 3

I'm aware that people have implemented password/passphrase generators before, but I still went ahead and wrote my own, which I actually use for my own passwords and/or phrases. By "secure", I mean ...
1
vote
3answers
166 views

PHP script security for new user registration

I would like to ask the experts here if this is secure. If it is not can I get an explanation as to why it would not be secure? I have been reading off and on on sites for this and I have trouble ...
2
votes
1answer
160 views

Safe string formatting in Python

I am a fan of f"{strings}" in Python, However some situations could possibly be dangerous when doing f strings from user input, leaking API keys or even code ...
1
vote
2answers
529 views

Secure random password generator

I am developing an application that must generate a random password for each new user in the system (initial password). My idea is to use passwords of 16 characters long. Would like to know if the ...
1
vote
0answers
456 views

Secure password hashing implementation with salt and pepper

I share below my password hashing implementation with salt and pepper in C#, for your review and feedback. In my implementation methods like ValidatePassword(), ChangePassword() are in the user class. ...
1
vote
2answers
46 views

Running shell script as root via external binary

I'm not an experienced Linux user and I wanted an easy way to run shell scripts as root from a PHP script, I came up with this: ...
1
vote
0answers
40 views

Simple ruby program for AWS ruby SDK

I wrote a simple ruby program for interacting with one of my temporary AWS S3 using Ruby SDK. Below is the program I've written. Since I learned ruby by myself I need help/suggestions in following ...
-3
votes
1answer
113 views

Format data for a CSV item

This function formats the text in each cell of a CSV. The goal of the function is to make sure that the sequence of characters in text will never break the cell's ...
4
votes
1answer
517 views

Generating absolute URIs behind a reverse proxy

In my ASP.NET MVC application there are occasions where I need to generate an absolute URI, such as when sending an email confirmation link to a user. The most straightforward approach is to use ...
6
votes
1answer
178 views

Password Hashing and SQL Queries

I am new to web development and am working on a portfolio piece, so I would like to make sure I'm not creating obvious vulnerabilities. I am wondering whether there are any clear flaws in the ...
1
vote
0answers
262 views

Using postMessage() in JavaScript with iframes for cross domain communication

I am trying to enable communication via JavaScript from an iframe and its parent window when they are on different domains. I did a lot of research and it turned out that ...
0
votes
1answer
190 views

Encryption scripts using the module cryptography

Its meant to password protect python scripts by using encryption It should use os.urandom(40)'s output in hex as the salt. The kdf (cryptography.io) is using Scrypt ...