Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [security]

Computer security is security applied to computing devices such as computers and smartphones, as well as to both private and public computer networks, including the whole Internet.

Filter by
Sorted by
Tagged with
0 votes
0 answers
55 views

Securing microservices with Spring Security JWT

I would like to build a RESTful microservices architecture where each microservice acts as a resource server. Additionally, there will be an authorization server responsible only for user registration,...
16 votes
0 answers
858 views

Let's register that Django user

Short intro So, I've been using Django for a while now and thought it would be nice to start a simple application. In an ideal World, each app must have a way of letting its users register and that's ...
2 votes
1 answer
44 views

Any possible issues with my approach to Access Management where I'm associating the list of Departments with the User class?

I have a spring boot project with JWT being used for Spring Security. I want to implement Access Management in my project and I'm using this approach. In my project, whenever a user is created, a list ...
5 votes
2 answers
205 views

Serve rescaled jpg images on demand with myphoto!500.jpg syntax (here 500px-width rescaled)

On web pages, obviously large photos (e.g. 4000x4000px) cannot be served with a reliance on CSS to do the resizing: it would be too slow for end users and too bandwidth-consuming for the server. So it'...
3 votes
0 answers
27 views

Using Pundit Policy Scopes with Searchkick Results

We are using Searchkick to run our elasticsearch and Pundit to authorize users for specific actions. Below is our module SearchkickScope that does it's best to ...
5 votes
3 answers
344 views

Cryptographically secure version of the core array_rand() function

I want a cryptographically secure version of array_rand(). Is this it? ...
2 votes
2 answers
222 views

Encrypt a String using AES in CBC mode

Your opinion interests me regarding this program. This program encrypts a text message using the AES256 algorithm and CBC. It allows the creation of an encrypted message that contains: The salt used ...
2 votes
1 answer
58 views

Reading a date from the start of a text webpage from github to determine if the program is fully updated

...
2 votes
1 answer
58 views

Production-Readiness Advice for Laravel/ PayPal Integration

I am currently working on integrating PayPal with my Laravel application, and it's my first time incorporating PayPal for production use. I have written the following code and would greatly appreciate ...
3 votes
1 answer
73 views

Implementation of aes-cbc-hmac combined with xchacha20-poly1305

I’m using two ciphers in this code that are in this order- encrypt plain text with xchacha20-poly1305 then encrypt the resulting ciphertext with aes-cbc-blake2b hmac. I was told elsewhere rather than ...
1 vote
1 answer
177 views

Is this string-comparison function safe against timing attacks?

Here's a JavaScript function that check the equality of input and secret strings, trying to do that without leaking information ...
5 votes
3 answers
184 views

Generating registration codes

I'm looking for a best practices and security analysis of some code I've written to generate registration codes and avoid duplicates. The class assigns numeric values to the letters A-Z and 0-9 and ...
5 votes
4 answers
3k views

Banking System console app in C++

I built a banking system in C++ (still a lot of features to do but (I decided to post it here to see what can I change so I wont make those mistakes in the future). User header and c++ files Header <...
1 vote
1 answer
149 views

Password keeper / generator application in Python

I've written this password-keeper application to keep my passwords safe in one place. From something over few lines it grew to almost 200 lines of code. I would greatly appreciate it if someone could ...
3 votes
1 answer
139 views

Python command line password generator

After giving a couple of well-received answers to similar questions, I thought I'd try to come up with my own solution. I believe that a good password generator can and should be quite simple without ...
2 votes
1 answer
208 views

All-JavaScript WhatsApp button

The following code creates a WhatsApp button. How would you improve this code? ...
2 votes
1 answer
142 views

sanitize untrusted input for templates

Attempting to populate HTML string-templates from untrusted input. ...
4 votes
1 answer
75 views

Basic node authentication system

I built a basic authentication system for a node application and I have some security concerns. The username and password the user enters when they log in are stored as plaintext using express-...
1 vote
0 answers
124 views

Modified PoC for BlogEngine.NET CMS (CVE-2019-6714)

This is a modified exploit proof of concept targeting the BlogEngine.NET content management system (CVE-2019-6714) for the .NET framework. I modified it (from Cobb 2019) to execute payloads via ...
0 votes
1 answer
75 views

Securely store password in database and then show it on demand? [closed]

I have written a small password manager script for my own purposes. It is hosted locally and cannot be accessed outside my local network. You can see the code on GutHub I know it is better to encrypt ...
1 vote
0 answers
2k views

Pay with PayPal through cURL and verify

As All PayPal PHP SDK deprecated, I wrote a simple PHP class to make payment with PayPal through cURL and verifying it. Note : I didn't add shipment details for payment because didn't need that. For ...
7 votes
3 answers
872 views

Brute force search for pdf password in python

I forgot the password to my pdf. I remembered a few characters, so I made a simple password-cracker program in Python. Is the document lost now given the number of combinations? Out of curiosity, how ...
3 votes
1 answer
2k views

Add post to favorite in PDO and mysql

After lot of research and couple of questions in https://stackoverflow.com/ i managed to create Favorite System in PDO mysql as ...
4 votes
0 answers
67 views

Serving Laravel public/ contents when all Laravel files are in the same server directory

I have a Laravel 8 project hosted at xxx/laravel/ on an Apache server, where xxx is the domain. I want to serve the contents of <...
4 votes
0 answers
3k views

Reactive JWT authentication using Spring webflux

Greeting to all senior devs here. I'm trying to create a project for my small business. There are not many tutorial on how to create Reactive JWT authentication with Spring webflux. So I'm a bit ...
3 votes
2 answers
1k views

Saving form data to a text file on server

I want to save simple string data as a simple text file (.txt) on the server (together with the IP), but I cannot find any clear guideline on how to do this correctly/efficiently/safely. (Maybe I'm ...
4 votes
0 answers
127 views

Securely generate Token for authentication

In my experience i had the need that some application (both desktop and web) can excange data to authenticate users (even if the data for authenticating users are not reacheable form desktop ...
10 votes
1 answer
281 views

Nested cross-origin iframes for secure user-configurable javascript tools

Context I'm trying to build a system in which a tool (the Client) will generate a header to be used as part of an HTTP request from the user's browser. The user should be able to choose their own ...
1 vote
1 answer
955 views

ASP.NET Core Authorization handler that allows request from private IP ranges

In a docker compose solution, there are multiple ASP.NET Core projects. Each of them provide a service. Some of them can be accessed from internet (with REST APIs), some of them are for local docker ...
6 votes
4 answers
2k views

Dynamically loading CSS files based on URL or URI in PHP

I have written out the following code in the head section of my document, which should load 3 separate style sheets for each page based on the URL/URI that the user is visiting. It is working as ...
4 votes
1 answer
141 views

Weighted Union-Find class

For a final project I used a weighted union-find and decided to implement it in Python. I wrote it to be as general as possible so it's very portable. I do plan on looking into path compression to ...
2 votes
1 answer
457 views

Password hashing for safe storage with Argon

This code snippet implements password hashing for safe storage. It uses Argon2 as hashing algorithm. The method hash_password() is used to hash and salt a password. ...
0 votes
1 answer
168 views

Password policy with regex and zxcvbn

This code snippet shows an implementation of a password policy check. - The method composition uses regex to verify that the password meets composition criteria (at least one number, one special ...
5 votes
1 answer
1k views

Rijndael Cipher in C++ (128bit AES)

I am a hobbyist and do not work in the industry, but I do have an interest in programming an cryptography. I decided to have a go at writing a 128bit implementation of AES in C++. This is my first ...
3 votes
0 answers
186 views

Simple websocket chat app

I'm coding a simple websocket chat app. I was wondering if my code is secure and efficient. I also have a question about the way how I'm sending objects and then checking the type, is there anything ...
6 votes
2 answers
885 views

Bash-based Port scanner (/dev/tcp)

This question is ideal in my case: Ludisposed's python-scapy-tcp-port-scan-of-subnet - At codereview stackexchange But this is not Scapy; nor Python(it might get used in the future though but that is ...
2 votes
2 answers
789 views

Security of a custom table in JsGrid

This code shows a table's records via JavaScript using a JsGrid file and can edit or delete by AJAX. This is my topic How can I load rows in JsGrid table that got from php file?, The problem I am not ...
1 vote
1 answer
150 views

Is this session manager secure?

I'm looking for best practices for writing secure session managers. I'm making a table for the authorization token (UUID OR GUIDv4) with autoincrement, user_id, token, status (enum) then update status ...
1 vote
1 answer
87 views

Python: token request, SQL user fetch and API calls

I have the files as below. What I'm looking for is some feedback with regards to security, reliability, maintenance, scaling and performance. What is going on? Make a request to get a token to access ...
1 vote
2 answers
83 views

Security of my upload script #2

I recently asked this question and got a response. I made improvements, it now checks if the file is an image and/or used UUID to store the images, and now I want to see if it's good or not. How ...
6 votes
1 answer
376 views

binary data shell echo generator

edit: here is a cleaned-up version incorporating most (but not all) feedback, thanks guys; https://gist.github.com/divinity76/79efd7b8c0d7849b956cd194659c98e5 edit2, 2021-07-16: found a bug (possible ...
1 vote
1 answer
584 views

How do I make my program that creates RSA keys and encrypts and decrypts a file more secure

...
2 votes
1 answer
541 views

Boolean expression evaluation for user input using evil eval

The following code is a module that evaluates boolean expressions, which are entered through an unauthorized web API. The exposed function of the library being used is ...
2 votes
1 answer
579 views

Protect Routes/Page with NextJS [closed]

I have a simple project that I built that protects the routes/pages of the website by using the if and else statement and putting each page with a function ...
10 votes
3 answers
3k views

Checking that a password contains a '$', a digit, and an uppercase letter

I have this code, which reads in a string password from the user and checks if it has a dollar sign $, a number, and an upper case letter. If it has all three, it ...
6 votes
0 answers
484 views

Bash script for pull-mode backups via restic's rest-server

I wrote the following Bash scripts to make pull-mode backups with restic, a backup solution written in Golang, similar to Borg Backup. The main use case for this script is pulling backups into a ...
2 votes
1 answer
170 views

Prevent Column Name Collision

I have been working on a series of posts about a library to connect to databases but most of the scenarios I have to resort to some "JOIN" the problem arose when two or more tables had some ...
6 votes
1 answer
210 views

upload multiple images and resize

I've written PHP code to upload multiple images to a server. This function processes a maximum of 10 images at one time and if any image's width or height is larger than 2000px it will resize it. But ...
1 vote
1 answer
1k views

script to recover browser passwords

basically i am new to python lookin for any bad practices done down there in my script, any ways to shrink the code and increase efficiency ...
1 vote
1 answer
80 views

Simple web page to enhance browsing of IMSLP music collections

I'm building a simple webpage that allow users to find the intersection of different category lists on a wiki (imslp.org) since the site itself does not offer this functionality. I have a simple HTML ...

1
2 3 4 5
16