Podcast #128: We chat with Kent C Dodds about why he loves React and discuss what life was like in the dark days before Git. Listen now.

Questions tagged [security]

Computer security is security applied to computing devices such as computers and smartphones, as well as to both private and public computer networks, including the whole Internet.

Filter by
Sorted by
Tagged with
1
vote
0answers
12 views

Decrypting a form always returns the previous authentication ticket values [closed]

I have an MVC application that uses Active Directory membership for user authentication. After the user logs in, a FormsAuthenticatedTicket is created and ...
5
votes
2answers
99 views

Keylogger in Python

I wrote a Keylogger in Python who transfers the Key Strokes to an S3 storage. What do you think about the Code? I would add the file saving in an other place and make it more legible. Feel free to ...
3
votes
1answer
39 views

Simple User and Database Relationship

Hello and thanks for clicking! I'm currently studying the relationship between a database and user objects. This is a very simple program and the "database" itself is a dictionary. This will be used ...
1
vote
1answer
33 views

Small service for hashing and validating passwords, using PBKDF2

As part of a larger authentication/authorization system, I've developed a small .NET Core 3.0 service for hashing passwords using PBKDF2 (with a salt) and validating passwords against a stored hash/...
5
votes
4answers
84 views

PDO MySQL queries for web application to reserve a vehicle

I normally use MySQLi and this is my first time trying out PDO. I am doing this because this is my first web application that is going to be used by the public, hence I want it to be secure. The code ...
1
vote
0answers
51 views

Getting around CORS error for displaying images on my website

I have my images stored in an S3 bucket and I am serving them from AWS CloudFront. I have created 2 CNAME records for the CloudFront: mywebsite.com and ...
1
vote
0answers
33 views

Functions to obfuscate and deobfuscate String. Am I missing out any edge cases?

I have 2 functions, which are going to hide/ unhide the multiple languages plain text. Security is not a major concern. The objectives are Just want to find a way to hide multiple ...
2
votes
0answers
22 views

Structure and Code of Tornado WebAPP

I wrote a test application to familiarize myself with the Tornado Python framework. The application currently generates a cookie that you can view and delete. I ...
5
votes
1answer
121 views

Python/Flask Password Manager

As a project to better my skills in Python, I wrote a password manager. It's a website that has user login/logout functionality, the ability to add websites and passwords, and displays the websites/...
7
votes
0answers
94 views

Nested cross-origin iframes for secure user-configurable javascript tools

Context I'm trying to build a system in which a tool (the Client) will generate a header to be used as part of an HTTP request from the user's browser. The user should be able to choose their own ...
2
votes
2answers
215 views

Codeigniter 3 Registration and Login System

I am working on a basic blog application in Codeigniter 3.1.8 and Bootstrap 4. The application allows Registration and Login. I have concerns about the security level of the Registration system I ...
1
vote
2answers
58 views

Creating a backup of a website directory inside the Web Application Root directory in *nix

In CentOS I have a Web Application Root on which I have a website directory. I would like to make an immediate backup of that website's directory by using the zip ...
1
vote
0answers
33 views

CSRF script in Php

A short script to make a CSRF token to be used in my html elements such as scripts, iframes & svgs. ...
2
votes
1answer
46 views

PHP allow template to use HTML only

I have a place where i have to include a HTML template. The HTML is written by employees only but i dont wanna be an idiot and include it without masking|checks :) It should allow HTML tags only ...
4
votes
2answers
99 views

AJAX communication with pure JS and PHP

I'm looking for a good approach to AJAX communication using only pure JS and PHP. I would like it to be as safe as possible and compatible with most modern browsers and IE 10+. I did some research and ...
3
votes
1answer
114 views

Capsulation solution for byte arrays

In a part of the project, I had to implement a solution for encapsulation of byte arrays. We do use ssh and secure ports for socket connection but I was in need of an extra layer of protection against ...
0
votes
1answer
32 views

Upload image with GD library

First of all I just started learning OOP. My priority is to make safe code. I think my code is safe, because I use GD to make a copy of the uploaded image and I use an image proxy to make sure nobody ...
2
votes
0answers
30 views

.htaccess file to enable compression, send security headers, and set cache expiration

This is the current .htaccess configuration for one of the website projects that I am working on, just as a learning exercise. This is working code and everything in it seems to be ok, My hosting ...
6
votes
3answers
844 views

Password maker in C#

I need to generate semi-complex throw-able passwords (just one use) in my application. I want it to be: at least 8 characters long; contains at least 1 digit, 1 [a-z] char, 1 [A-Z] char; I generate ...
2
votes
1answer
67 views

Remediation for security vulnerability due to storing sensitive information in strings

Security assessment of our codebase reported the following vulnerability - Vulnerability Description The method x() in xyz.java stores sensitive data in a String object, making it ...
-2
votes
1answer
58 views

Bodyless Self-Closing *for* Loop [closed]

I use self-closing bodyless for loop to quickly find an element within an array or collection. Learned it from a Java teacher. But I'm seeing warnings on certain IDEs that have a code inspection tool. ...
1
vote
1answer
92 views

Expose encrypted serial ID in Elixir

I'm working on a Phoenix/Absinthe application and I thought to expose encrypted sequential IDs instead of UUIDs since these are a bit shorter. Encryption on Elixir/Erlang seems very hard, so I think I'...
1
vote
1answer
120 views

Light Security Local-Machine Password Encryption

I have a program that makes a call to an SQL database. I cannot use SSH to connect to it (as far as I am aware) or any other more secure method, so Java's SQL connector was used. As the connection ...
11
votes
1answer
181 views

Safe dynamic SQL for generic search

Prompted by discussion about SQL injection, I wanted to put a proof of concept forward to get feedback about whether this is in fact safe and protected against SQL injection or other malicious use. ...
3
votes
2answers
79 views

Elegant and secure way to create a dynamic query

I want to create a dynamic query to display: all the invoices if the user has moderator rank only his invoices if the user is a simple member code ...
6
votes
1answer
99 views

Password validator making zxcvbn easy to use with Django

This is a translatable password validator for django, based on zxcvbn-python and available with ...
2
votes
1answer
71 views

Using Curl/Post to execute a HTTP request

I have a loop in a php file to HTTP_Request Server Via CURL->POST. But I don't know if I'm missing any security considerations. Also, is there a better way to perform this http request? ...
2
votes
1answer
48 views

Secure file upload in PHP

I've coded this function as a secure file upload function in PHP. Currently I'm woking on an academic grading system (PHP script) which's really sensitive, so tell me what you think, and if you have ...
6
votes
3answers
245 views

Dynamically loading CSS files based on URL or URI in PHP

I have written out the following code in the head section of my document, which should load 3 separate style sheets for each page based on the URL/URI that the user is visiting. It is working as ...
7
votes
0answers
52 views

Fun crypto problem: Exploiting a vulnerable encryption scheme with Python

I came across a question asked here and here on the Crypto Stack Exchange site, and decided to analyze it as a kind of case study. To demonstrate the concept, I wrote a short python script depicting ...
0
votes
0answers
45 views

Using System.Security.Cryptography.Aes to generate encryption key

Is the below method a safe way of generating a random encryption key to be used with AES (SymmetricAlgorithm) in .NET? It essentially piggybacks off of the Aes alg to create a random key, trimmed to ...
2
votes
1answer
35 views

SSO login & authenticate Wordpress users with JWT token

I'm in the midst of exploring SSO with JWT & Wordpress, I'm not too sure if it's a good practice or does this setup/flow have any security vulnerabilities. Currently JWT/SSO method i'm using is ...
15
votes
1answer
209 views

Security audit of open-source, RSA Blind Signature library

I've just published a small library implementing the RSA Blind Signature process. Here's the GitHub repo! I needed something portable, and easy enough to use that I could ask other people to ...
2
votes
0answers
31 views

WordPress rest api basic auth with IP check

I'd like to use basic auth with the WordPress API, but restrict the capability to a single IP address. I've updated the existing code from here: https://github.com/WP-API/Basic-Auth accordingly. It ...
1
vote
1answer
91 views

employing AES algorithm in Java

I have employed an AES algorithm in order to encrypt files within a GUI. I was wondering if my algorithm is secure. Could I change anything to improve it? Is my IV secure and is it producing different ...
12
votes
3answers
3k views

Python password manager

I am writing a python password manager, and I know there's a lot of scrutiny that goes into storing passwords (don't worry, mine aren't plaintext). I was hoping that this community could help me ...
2
votes
0answers
36 views

Custom Security for API access from server to mobile application

i am not the best at security but need a custom way to securely store personal identifiable information like name, address etc - Can i please have some feedback on this custom code, from my ...
11
votes
2answers
2k views

Employing 3DES algorithm in Java

I am making a project just for fun that employs the 3DES algorithm in Java. I was wondering if my algorithm looks secure. Is there any advice or feedback you could give me? Do I need to include an IV? ...
4
votes
1answer
418 views

Secure session handling in PHP

I tried to search and read for 10-12 hours on how to have a secure session, and this is the (simplified version of the) code that I came up with. (found no good book or article with complete guide ...
3
votes
3answers
100 views

httprequest to php login system

I'm trying to make a login system for my website which I'll be releasing in public later on. I have inserted some main samples of my code in here and I would like some useful advise or suggestions. ...
3
votes
0answers
81 views

Django authentication against Exchange server

I wrote an authentication app for Django and my worry is primarily about the security of my app. My Django authentication app uses exchangelib to authenticate ...
0
votes
1answer
40 views

Delete directory tree function

I made this function to delete a directory with all its contents recursively, will it work as expected in a production environment ? is it safe ? I don't want to wake up one day with ...
2
votes
1answer
44 views

Encrypts using AES GCM for data with limited visibility and long rest

This is the third iteration of my venture on creating an encryption/decryption solution. I asked a question here, which led to this question here, which led to this answer here, which led me to ...
2
votes
1answer
63 views

Store a hash in a cookie to identify the user's account to keep logged in after close browser

I made a option to user choose to stay logged in even after he closes the browser. It's really simple to implement, but i'm not sure about the hash i used to identify the user that is stored in a ...
1
vote
1answer
539 views

RSA wrapper written in Kotlin

I've written up a small wrapper for RSA and AES encryption in Kotlin, and I want to make sure I'm not making any glaring mistakes before use it. This is going on a small project with basically no ...
3
votes
2answers
254 views

Database Model Security For Book Inventory

This code is one of the models developed for the Book Inventory application that is open for review. It is also based on a comment on this answer to a C# question. Based on the comment I did some ...
2
votes
1answer
97 views

C# Login Form, Login Button , security

So, I am new to VS and C#, I am self-teaching to get a better understanding of the back-end of the product I work with. I have created a small database with some information and a Login form. ...
2
votes
1answer
48 views

Wipe sensitive information from memory in Python

I have come up with the following method to remove sensitive information with the help of the garbage collector: ...
2
votes
1answer
84 views

AES CTR mode encryption with HMAC

I am trying to implement AES CTR encryption mode with HMAC authentication for messages. It's encrypting and decrypting fine as long as the key length is 64 bytes, since AES key and HMAC key are ...
2
votes
1answer
297 views

Effective & Secure Method to populate Access Token for authorization header in Rest Template

I am trying to consume a REST endpoint by using the RestTemplate Library provided by the spring framework. The endpoint also demands a Bearer Access Token as its authorization header, which is only ...