Questions tagged [security]
Computer security is security applied to computing devices such as computers and smartphones, as well as to both private and public computer networks, including the whole Internet.
768
questions
14
votes
1
answer
1k
views
Typical password generator in Python
Password generators are extremely popular on CodeReview with beginners to both coding in general and Python in particular, for a number of reasons:
They're (seemingly) easy to implement
They offer an ...
3
votes
1
answer
99
views
Auth0 Credentials Manager in Android app
I am building an Android app that communicates with a REST API using Retrofit2 and uses Auth0 for authentication. The Android app needs to store access token from Auth0 and use it to authorize its ...
- 31
3
votes
1
answer
50
views
Creating an API secured only by the request signature
I'm trying to create an API that will receive requests from users without having to do a login request. They will just have a user id and a key. My intention is that they will use the key to create a ...
user283696
0
votes
0
answers
82
views
Securing microservices with Spring Security JWT
I would like to build a RESTful microservices architecture where each microservice acts as a resource server. Additionally, there will be an authorization server responsible only for user registration,...
2
votes
1
answer
50
views
Any possible issues with my approach to Access Management where I'm associating the list of Departments with the User class?
I have a spring boot project with JWT being used for Spring Security. I want to implement Access Management in my project and I'm using this approach. In my project, whenever a user is created, a list ...
- 23
3
votes
0
answers
34
views
Using Pundit Policy Scopes with Searchkick Results
We are using Searchkick to run our elasticsearch and Pundit to authorize users for specific actions. Below is our module SearchkickScope that does it's best to ...
- 81
2
votes
2
answers
224
views
Encrypt a String using AES in CBC mode
Your opinion interests me regarding this program.
This program encrypts a text message using the AES256 algorithm and CBC.
It allows the creation of an encrypted message that contains:
The salt used ...
- 33
2
votes
1
answer
59
views
2
votes
1
answer
62
views
Production-Readiness Advice for Laravel/ PayPal Integration
I am currently working on integrating PayPal with my Laravel application, and it's my first time incorporating PayPal for production use. I have written the following code and would greatly appreciate ...
3
votes
1
answer
77
views
Implementation of aes-cbc-hmac combined with xchacha20-poly1305
I’m using two ciphers in this code that are in this order- encrypt plain text with xchacha20-poly1305 then encrypt the resulting ciphertext with aes-cbc-blake2b hmac.
I was told elsewhere rather than ...
- 31
1
vote
1
answer
191
views
Is this string-comparison function safe against timing attacks?
Here's a JavaScript function that check the equality of input and secret strings, trying to do that without leaking information ...
- 123
5
votes
3
answers
184
views
Generating registration codes
I'm looking for a best practices and security analysis of some code I've written to generate registration codes and avoid duplicates.
The class assigns numeric values to the letters A-Z and 0-9 and ...
- 51
5
votes
4
answers
3k
views
Banking System console app in C++
I built a banking system in C++ (still a lot of features to do but (I decided to post it here to see what can I change so I wont make those mistakes in the future).
User header and c++ files
Header
<...
- 549
3
votes
1
answer
150
views
Python command line password generator
After giving a couple of well-received answers to similar questions, I thought I'd try to come up with my own solution.
I believe that a good password generator can and should be quite simple without ...
- 3,359
1
vote
1
answer
151
views
Password keeper / generator application in Python
I've written this password-keeper application to keep my passwords safe in one place. From something over few lines it grew to almost 200 lines of code. I would greatly appreciate it if someone could ...
- 161
4
votes
1
answer
79
views
Basic node authentication system
I built a basic authentication system for a node application and I have some security concerns. The username and password the user enters when they log in are stored as plaintext using express-...
- 43
1
vote
0
answers
139
views
Modified PoC for BlogEngine.NET CMS (CVE-2019-6714)
This is a modified exploit proof of concept targeting the BlogEngine.NET content management system (CVE-2019-6714) for the .NET framework. I modified it (from Cobb 2019) to execute payloads via ...
- 183
0
votes
1
answer
78
views
Securely store password in database and then show it on demand? [closed]
I have written a small password manager script for my own purposes. It is hosted locally and cannot be accessed outside my local network. You can see the code on GutHub
I know it is better to encrypt ...
- 147
2
votes
1
answer
211
views
All-JavaScript WhatsApp button
The following code creates a WhatsApp button.
How would you improve this code?
...
- 21
1
vote
0
answers
2k
views
Pay with PayPal through cURL and verify
As All PayPal PHP SDK deprecated, I wrote a simple PHP class to make payment with PayPal through cURL and verifying it. Note :
I didn't add shipment details for payment because didn't need that.
For ...
- 111
7
votes
3
answers
880
views
Brute force search for pdf password in python
I forgot the password to my pdf. I remembered a few characters, so I made a simple password-cracker program in Python. Is the document lost now given the number of combinations? Out of curiosity, how ...
- 71
4
votes
0
answers
69
views
Serving Laravel public/ contents when all Laravel files are in the same server directory
I have a Laravel 8 project hosted at xxx/laravel/ on an Apache server, where xxx is the domain. I want to serve the contents of <...
- 93
4
votes
0
answers
3k
views
Reactive JWT authentication using Spring webflux
Greeting to all senior devs here. I'm trying to create a project for my small business. There are not many tutorial on how to create Reactive JWT authentication with Spring webflux. So I'm a bit ...
- 331
3
votes
2
answers
1k
views
Saving form data to a text file on server
I want to save simple string data as a simple text file (.txt) on the server (together with the IP), but I cannot find any clear guideline on how to do this correctly/efficiently/safely. (Maybe I'm ...
- 163
4
votes
0
answers
127
views
Securely generate Token for authentication
In my experience i had the need that some application (both desktop and web) can excange data to authenticate users (even if the data for authenticating users are not reacheable form desktop ...
- 248
1
vote
1
answer
964
views
ASP.NET Core Authorization handler that allows request from private IP ranges
In a docker compose solution, there are multiple ASP.NET Core projects. Each of them provide a service. Some of them can be accessed from internet (with REST APIs), some of them are for local docker ...
- 133
0
votes
1
answer
168
views
Password policy with regex and zxcvbn
This code snippet shows an implementation of a password policy check.
- The method composition uses regex to verify that the password meets composition criteria (at least one number, one special ...
- 45
2
votes
1
answer
465
views
Password hashing for safe storage with Argon
This code snippet implements password hashing for safe storage. It uses Argon2 as hashing algorithm. The method hash_password() is used to hash and salt a password. ...
- 45
5
votes
3
answers
347
views
Cryptographically secure version of the core array_rand() function
I want a cryptographically secure version of array_rand(). Is this it?
...
- 437
3
votes
0
answers
188
views
Simple websocket chat app
I'm coding a simple websocket chat app. I was wondering if my code is secure and efficient.
I also have a question about the way how I'm sending objects and then checking the type, is there anything ...
- 31
5
votes
1
answer
1k
views
Rijndael Cipher in C++ (128bit AES)
I am a hobbyist and do not work in the industry, but I do have an interest in programming an cryptography. I decided to have a go at writing a 128bit implementation of AES in C++. This is my first ...
- 195
4
votes
1
answer
143
views
Weighted Union-Find class
For a final project I used a weighted union-find and decided to implement it in Python. I wrote it to be as general as possible so it's very portable. I do plan on looking into path compression to ...
- 143
6
votes
2
answers
894
views
Bash-based Port scanner (/dev/tcp)
This question is ideal in my case: Ludisposed's python-scapy-tcp-port-scan-of-subnet - At codereview stackexchange
But this is not Scapy; nor Python(it might get used in the future though but that is ...
- 161
1
vote
1
answer
151
views
Is this session manager secure?
I'm looking for best practices for writing secure session managers.
I'm making a table for the authorization token (UUID OR GUIDv4) with autoincrement, user_id, token, status (enum) then update status ...
- 37
1
vote
1
answer
88
views
Python: token request, SQL user fetch and API calls
I have the files as below. What I'm looking for is some feedback with regards to security, reliability, maintenance, scaling and performance.
What is going on?
Make a request to get a token to access ...
- 380
1
vote
2
answers
83
views
Security of my upload script #2
I recently asked this question and got a response. I made improvements, it now checks if the file is an image and/or used UUID to store the images, and now I want to see if it's good or not.
How ...
- 449
2
votes
1
answer
544
views
Boolean expression evaluation for user input using evil eval
The following code is a module that evaluates boolean expressions, which are entered through an unauthorized web API. The exposed function of the library being used is ...
- 6,221
1
vote
1
answer
600
views
5
votes
2
answers
205
views
Serve rescaled jpg images on demand with myphoto!500.jpg syntax (here 500px-width rescaled)
On web pages, obviously large photos (e.g. 4000x4000px) cannot be served with a reliance on CSS to do the resizing: it would be too slow for end users and too bandwidth-consuming for the server.
So it'...
- 264
2
votes
1
answer
583
views
Protect Routes/Page with NextJS [closed]
I have a simple project that I built that protects the routes/pages of the website by using the if and else statement and putting each page with a function ...
- 125
6
votes
0
answers
505
views
Bash script for pull-mode backups via restic's rest-server
I wrote the following Bash scripts to make pull-mode backups with restic, a backup solution written in Golang, similar to Borg Backup. The main use case for this script is pulling backups into a ...
- 353
2
votes
1
answer
170
views
Prevent Column Name Collision
I have been working on a series of posts about a library to connect to databases but most of the scenarios I have to resort to some "JOIN" the problem arose when two or more tables had some ...
user152284
1
vote
1
answer
1k
views
script to recover browser passwords
basically i am new to python lookin for any bad practices done down there in my script, any ways to shrink the code and increase efficiency
...
- 147
1
vote
1
answer
81
views
Simple web page to enhance browsing of IMSLP music collections
I'm building a simple webpage that allow users to find the intersection of different category lists on a wiki (imslp.org) since the site itself does not offer this functionality. I have a simple HTML ...
- 63
3
votes
1
answer
135
views
A simple C# script that exploits PHP command injections
Back in 2016, I wrote a simple C# script that exploits a generic command injection vulnerability on PHP webapps, just for the sake of demonstrating that exploits can be written in .NET languages (due ...
- 183
4
votes
1
answer
2k
views
.Net 5.0 Get User Email From Claims
From searching online I have identified two ways to get the user email, but I don't know if either has pro's/con's beyond Option.1 being a larger number of lines of code?
Option.1
I have a dedicated <...
- 143
5
votes
1
answer
144
views
Storing and confirming user input
I am a beginner, and I'm trying to secure a sign-login system on my website. Is my code good/enough to prevent SQL injection?
THIS IS THE SIGN FILES
This is the index.php that takes user input:
...
- 173
4
votes
1
answer
81
views
Security of the login code on the website
I wrote the code to log in php to the admin panel. Everything works as it should. But I am not sure if it is well written code and if it is safe. I care about security. I have read a lot about it but ...
- 41
1
vote
1
answer
57
views
Please check out my code incrementer
I recently developed code that can run as a function parameter but I'm not quite sure how vulnerable it is to hacks and/or cheats.
Also, is there anything I could improve?
...
5
votes
2
answers
963
views
Securing my password wallet
I am currently learning C++, so I made this basic password wallet for Ubuntu.
Its source code is in the /opt directory and it has a symlink so i can launch it from ...
