Questions tagged [security]

Computer security is security applied to computing devices such as computers and smartphones, as well as to both private and public computer networks, including the whole Internet.

Filter by
Sorted by
Tagged with
1
vote
0answers
14 views

.htaccess file syntax check? security check?

This is one of my main .htaccess files and I'm wondering if anyone can review it and tell me if I have the syntax correct, I'm still not 100% sure what should and shouldn't be inside a module, I know ...
0
votes
1answer
29 views

Upload image with GD library

First of all I just started learning OOP. My priority is to make safe code. I think my code is safe, because I use GD to make a copy of the uploaded image and I use an image proxy to make sure nobody ...
2
votes
0answers
19 views

.htaccess file to enable compression, send security headers, and set cache expiration

This is the current .htaccess configuration for one of the website projects that I am working on, just as a learning exercise. This is working code and everything in it seems to be ok, My hosting ...
6
votes
3answers
774 views

Password maker in C#

I need to generate semi-complex throw-able passwords (just one use) in my application. I want it to be: at least 8 characters long; contains at least 1 digit, 1 [a-z] char, 1 [A-Z] char; I generate ...
1
vote
0answers
41 views

Remediation for security vulnerability due to storing sensitive information in strings

Security assessment of our codebase reported the following vulnerability - Vulnerability Description The method x() in xyz.java stores sensitive data in a String object, making it ...
-2
votes
1answer
53 views

Bodyless Self-Closing *for* Loop [closed]

I use self-closing bodyless for loop to quickly find an element within an array or collection. Learned it from a Java teacher. But I'm seeing warnings on certain IDEs that have a code inspection tool. ...
0
votes
0answers
69 views

Expose encrypted serial ID in Elixir

I'm working on a Phoenix/Absinthe application and I thought to expose encrypted sequential IDs instead of UUIDs since these are a bit shorter. Encryption on Elixir/Erlang seems very hard, so I think I'...
1
vote
1answer
99 views

Light Security Local-Machine Password Encryption

I have a program that makes a call to an SQL database. I cannot use SSH to connect to it (as far as I am aware) or any other more secure method, so Java's SQL connector was used. As the connection ...
8
votes
0answers
151 views

Safe dynamic SQL for generic search

Prompted by discussion about SQL injection, I wanted to put a proof of concept forward to get feedback about whether this is in fact safe and protected against SQL injection or other malicious use. ...
3
votes
2answers
74 views

Elegant and secure way to create a dynamic query

I want to create a dynamic query to display: all the invoices if the user has moderator rank only his invoices if the user is a simple member code ...
6
votes
1answer
67 views

Password validator making zxcvbn easy to use with Django

This is a translatable password validator for django, based on zxcvbn-python and available with ...
2
votes
1answer
64 views

Using Curl/Post to execute a HTTP request

I have a loop in a php file to HTTP_Request Server Via CURL->POST. But I don't know if I'm missing any security considerations. Also, is there a better way to perform this http request? ...
2
votes
1answer
42 views

Secure file upload in PHP

I've coded this function as a secure file upload function in PHP. Currently I'm woking on an academic grading system (PHP script) which's really sensitive, so tell me what you think, and if you have ...
6
votes
3answers
232 views

Dynamically loading CSS files based on URL or URI in PHP

I have written out the following code in the head section of my document, which should load 3 separate style sheets for each page based on the URL/URI that the user is visiting. It is working as ...
6
votes
0answers
39 views

Fun crypto problem: Exploiting a vulnerable encryption scheme with Python

I came across a question asked here and here on the Crypto Stack Exchange site, and decided to analyze it as a kind of case study. To demonstrate the concept, I wrote a short python script depicting ...
0
votes
0answers
40 views

Using System.Security.Cryptography.Aes to generate encryption key

Is the below method a safe way of generating a random encryption key to be used with AES (SymmetricAlgorithm) in .NET? It essentially piggybacks off of the Aes alg to create a random key, trimmed to ...
2
votes
1answer
30 views

SSO login & authenticate Wordpress users with JWT token

I'm in the midst of exploring SSO with JWT & Wordpress, I'm not too sure if it's a good practice or does this setup/flow have any security vulnerabilities. Currently JWT/SSO method i'm using is ...
15
votes
1answer
190 views

Security audit of open-source, RSA Blind Signature library

I've just published a small library implementing the RSA Blind Signature process. Here's the GitHub repo! I needed something portable, and easy enough to use that I could ask other people to ...
2
votes
0answers
23 views

WordPress rest api basic auth with IP check

I'd like to use basic auth with the WordPress API, but restrict the capability to a single IP address. I've updated the existing code from here: https://github.com/WP-API/Basic-Auth accordingly. It ...
1
vote
1answer
89 views

employing AES algorithm in Java

I have employed an AES algorithm in order to encrypt files within a GUI. I was wondering if my algorithm is secure. Could I change anything to improve it? Is my IV secure and is it producing different ...
12
votes
3answers
2k views

Python password manager

I am writing a python password manager, and I know there's a lot of scrutiny that goes into storing passwords (don't worry, mine aren't plaintext). I was hoping that this community could help me ...
2
votes
0answers
36 views

Custom Security for API access from server to mobile application

i am not the best at security but need a custom way to securely store personal identifiable information like name, address etc - Can i please have some feedback on this custom code, from my ...
11
votes
2answers
2k views

Employing 3DES algorithm in Java

I am making a project just for fun that employs the 3DES algorithm in Java. I was wondering if my algorithm looks secure. Is there any advice or feedback you could give me? Do I need to include an IV? ...
4
votes
1answer
153 views

Secure session handling in PHP

I tried to search and read for 10-12 hours on how to have a secure session, and this is the (simplified version of the) code that I came up with. (found no good book or article with complete guide ...
3
votes
3answers
85 views

httprequest to php login system

I'm trying to make a login system for my website which I'll be releasing in public later on. I have inserted some main samples of my code in here and I would like some useful advise or suggestions. ...
3
votes
0answers
46 views

Django authentication against Exchange server

I wrote an authentication app for Django and my worry is primarily about the security of my app. My Django authentication app uses exchangelib to authenticate ...
0
votes
1answer
38 views

Delete directory tree function

I made this function to delete a directory with all its contents recursively, will it work as expected in a production environment ? is it safe ? I don't want to wake up one day with ...
2
votes
1answer
38 views

Encrypts using AES GCM for data with limited visibility and long rest

This is the third iteration of my venture on creating an encryption/decryption solution. I asked a question here, which led to this question here, which led to this answer here, which led me to ...
2
votes
1answer
59 views

Store a hash in a cookie to identify the user's account to keep logged in after close browser

I made a option to user choose to stay logged in even after he closes the browser. It's really simple to implement, but i'm not sure about the hash i used to identify the user that is stored in a ...
1
vote
1answer
161 views

RSA wrapper written in Kotlin

I've written up a small wrapper for RSA and AES encryption in Kotlin, and I want to make sure I'm not making any glaring mistakes before use it. This is going on a small project with basically no ...
3
votes
2answers
224 views

Database Model Security For Book Inventory

This code is one of the models developed for the Book Inventory application that is open for review. It is also based on a comment on this answer to a C# question. Based on the comment I did some ...
2
votes
1answer
94 views

C# Login Form, Login Button , security

So, I am new to VS and C#, I am self-teaching to get a better understanding of the back-end of the product I work with. I have created a small database with some information and a Login form. ...
2
votes
1answer
41 views

Wipe sensitive information from memory in Python

I have come up with the following method to remove sensitive information with the help of the garbage collector: ...
2
votes
1answer
56 views

AES CTR mode encryption with HMAC

I am trying to implement AES CTR encryption mode with HMAC authentication for messages. It's encrypting and decrypting fine as long as the key length is 64 bytes, since AES key and HMAC key are ...
2
votes
1answer
68 views

Effective & Secure Method to populate Access Token for authorization header in Rest Template

I am trying to consume a REST endpoint by using the RestTemplate Library provided by the spring framework. The endpoint also demands a Bearer Access Token as its authorization header, which is only ...
3
votes
1answer
120 views

Is it enough for PHP secure session class?

I need you help with my php session class. I can not understand, the class implements adequate work with sessions. By adequate work, I understand the security and correctness of the methods. ...
3
votes
2answers
132 views

PHP Secure Login Scripts

I have created this login script for a website I'm making; basically I want to make it as secure as possible, but also I want it to keep users logged in for 30 minutes. For example if I've logged in ...
2
votes
0answers
65 views

Python RSA/DSA File Cryptography, Key Generation, Key Protection

I have forked a previous version of my script, critiqued here: Generate public/private keys, encrypt, decrypt, sign, verify This program allows you to encrypt and decrypt raw files using RSA keys ...
6
votes
1answer
66 views

Simple bash script creates apache2 virtualhost config for subdomain

Simple bash script to create apache2 virtualhost for localhost. Can be used for public subdomains on developer server with changes - "replace .localhost". Tested on Ubuntu, but should work where ...
0
votes
0answers
58 views

Sandboxing untrusted JavaScript execution by redeclaring variables

Suppose, via AJAX, I downloaded a string jsCode containing JavaScript code from a (potentially malicious) third-party website. I want to allow the code to implement ...
7
votes
2answers
727 views

Reading source code and extracting json from a url

I made a program to read the source code from a url. To reach this url I need to specify a token. After read the source code, I extract a url in json format, andIi ...
5
votes
2answers
73 views

PHP password-resetting page

I am producing a PHP code and I want to implement it in my server to do its function. My question is, are there any vulnerabilities that I should correct? I tried to establish the session first then ...
2
votes
0answers
61 views

Python/Django Class based saving

I'm creating multiple Django apps with vote possibilities, so I made an app vote to handle all this votes. In my templates I'm including an ajax-function named <...
3
votes
1answer
354 views

Upload a user's avatar

Could you guys tell me if my code is safe? And i want to know how to improve it. You will see a detailed explanation about the code on the comment blocks inside the code. profileIMGform.php <...
3
votes
2answers
96 views

PHP login system with prevention for session hijacking, fixation, injection, etc

I'm creating a login system and I have been reading a lot about the security measures needed to prevent session hijacking, fixation, and injection attacks, etc. These two Stack Overflow posts were ...
3
votes
1answer
48 views

PHP remote upload security

I need to upload images to a remote HTTP server from a local script. The image name format is {32-char MD5}.jpg. Server directory format is ...
3
votes
1answer
59 views

Queries to print out on the screen a list of menus

For common users I have 10 queries and for registered users I have 30 queries like this one below, only to print out on the screen the link for the querystrings, a guy said to me that I should escape ...
3
votes
1answer
145 views

Enhancing PHP realpath($path);

PHP realpath($path); is insufficient for some cases since it returns false on paths that dont exist on a file system. I need a function that extends realpath($path); to return even path that does not ...
2
votes
1answer
346 views

Notification system using PHP+jQuery+Ajax

I have this code to display a counter on the side of <i class="fas fa-bell mr-3"></i>. I want to know if this code is good on security and perfomance. ...
2
votes
1answer
199 views

Login system with password reset sent to e-mail using PHP and PDO

I really like to use PDO because it's simple and easy to make a safe query, i prepared all queries and used placeholders, i think it's safe but i'm not sure at all, and I'm thinking if i used ...