Questions tagged [security]

Computer security is security applied to computing devices such as computers and smartphones, as well as to both private and public computer networks, including the whole Internet.

65 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
13 votes
0 answers
776 views

Let's register that Django user

Short intro So, I've been using Django for a while now and thought it would be nice to start a simple application. In an ideal World, each app must have a way of letting its users register and that's ...
user avatar
10 votes
0 answers
231 views

Nested cross-origin iframes for secure user-configurable javascript tools

Context I'm trying to build a system in which a tool (the Client) will generate a header to be used as part of an HTTP request from the user's browser. The user should be able to choose their own ...
user avatar
5 votes
0 answers
1k views

Secure Password and Passphrase Generator in Python 3

I'm aware that people have implemented password/passphrase generators before, but I still went ahead and wrote my own, which I actually use for my own passwords and/or phrases. By "secure", I mean ...
user avatar
4 votes
0 answers
431 views

Clear-net browsing with Lynx over Tor

This project is designed to enable clear-net browsing over the Tor network with the Lynx web-browser. Currently everything seems to be functioning as intended, however, it would be most appreciated if ...
user avatar
  • 976
4 votes
0 answers
110 views

Automatically encrypting text editor

I have written an automatically encrypting text editor (github link). The reasons that I wrote this program instead of using vim + gpg are: It's more convenient than vim + gpg (user only needs to ...
user avatar
  • 41
4 votes
0 answers
118 views

(de-)serializer for arbitrary python objects

My program is intended to allow (de-)serialization of arbitrary Python objects. It's basically a replacement for python's pickle module, which is similar but prone ...
user avatar
  • 143
4 votes
0 answers
7k views

OpenSSL Client/Server

I have recently begun to dabble with OpenSSL to provide TLS encryption to TCP socket communication. Through documentation and heavy reference on example code I have come up with the following code (...
user avatar
4 votes
0 answers
786 views

OAuth 2.0 implicit flow implementation

I have been implementing the OAuth 2.0 implicit flow to secure the API I use in an Angular SAP. Please, could you review my code? I am sure there is a lot of stuff to improve in it. I have separated ...
user avatar
3 votes
0 answers
118 views

Bash script for pull-mode backups via restic's rest-server

I wrote the following Bash scripts to make pull-mode backups with restic, a backup solution written in Golang, similar to Borg Backup. The main use case for this script is pulling backups into a ...
user avatar
  • 323
3 votes
0 answers
372 views

Creating SQL Server Database Users Dynamically from User Input

The Application I have an application in testing that runs off of an MS SQL Server database. The app allows users to authenticate using Windows authentication (that is, using the Windows username the ...
user avatar
3 votes
0 answers
64 views

.htaccess file to enable compression, send security headers, and set cache expiration

This is the current .htaccess configuration for one of the website projects that I am working on, just as a learning exercise. This is working code and everything ...
user avatar
3 votes
0 answers
300 views

Codeigniter 3 loading models in a different way

I'm currently building an application that uses the same models in different controllers. Instead of using the normal way, being loading the model in the controller I've build a "core controller" (<...
user avatar
  • 31
3 votes
0 answers
86 views

Implementing secure API for use between other internal apps

My team and I are trying to implement a secure API and would appreciate some feedback on the following: If there are areas of improvement in the current code to improve security Recommendations on ...
user avatar
  • 31
3 votes
0 answers
2k views

File encryption/decryption in Python

How secure is this Python code? Can there be any attacks on this encryption? I tried to follow all the rules that I could find: KDF instead of hash, EAX (authenticated encryption mode) and other. <...
user avatar
  • 31
3 votes
0 answers
558 views

Python Keylogger

Just a simple utility that logs the pressed keys in Python and takes a screenshot everytime a new PID is opened. Ì got bored at work, so decided I was going to have some fun with this. Made in ...
user avatar
  • 11.4k
3 votes
0 answers
62 views

PL/pgSQL autologin token generation

Here's an excerpt from my migration script for my database for the new "remember me" login option for my web application. Logging in with a valid username/password combination (authenticate_user) ...
user avatar
  • 3,624
3 votes
0 answers
291 views

Streamed encrypt then MAC construction

I've been porting python Keyczar to work under 2to3 conversion (Github). I wanted to consolidate its streaming AES encrypt/decrypt backend interface with its string decrypt/encrypt. So I wrote a new ...
user avatar
  • 341
2 votes
0 answers
106 views

Simple websocket chat app

I'm coding a simple websocket chat app. I was wondering if my code is secure and efficient. I also have a question about the way how I'm sending objects and then checking the type, is there anything ...
user avatar
  • 21
2 votes
0 answers
50 views

Basic flask template with sessions

This Flask app, which makes use of SQLAlchemy, a MySQL server which is only reachable via SSH and Flask-Login, is the base on which I want to write an application which has login protected pages. ...
user avatar
  • 105
2 votes
0 answers
72 views

JWT authentication system login through API

This is my first time writing an authentication system. Here's how it works, first client needs to send credential within authorization header like { Authorization : 'Basic ' + credential } through ...
user avatar
  • 271
2 votes
0 answers
158 views

Production ready user signup, login and logout using python and tornado

Please review my code with the following in mind: Does anyone see a reason to make this asynchronous, why would i do that? How do i work out the maximum number of users it can handle at one time? at ...
user avatar
2 votes
0 answers
67 views

Structure and Code of Tornado WebAPP

I wrote a test application to familiarize myself with the Tornado Python framework. The application currently generates a cookie that you can view and delete. I ...
user avatar
2 votes
0 answers
84 views

CSRF script in Php

A short script to make a CSRF token to be used in my html elements such as inputs, file-uploads, scripts, iframes & svgs. ...
user avatar
2 votes
0 answers
107 views

WordPress rest api basic auth with IP check

I'd like to use basic auth with the WordPress API, but restrict the capability to a single IP address. I've updated the existing code from here: https://github.com/WP-API/Basic-Auth accordingly. It ...
user avatar
  • 121
2 votes
0 answers
40 views

Custom Security for API access from server to mobile application

i am not the best at security but need a custom way to securely store personal identifiable information like name, address etc - Can i please have some feedback on this custom code, from my ...
user avatar
2 votes
0 answers
177 views

Django authentication against Exchange server

I wrote an authentication app for Django and my worry is primarily about the security of my app. My Django authentication app uses exchangelib to authenticate ...
user avatar
2 votes
0 answers
669 views

Python RSA/DSA File Cryptography, Key Generation, Key Protection

I have forked a previous version of my script, critiqued here: Generate public/private keys, encrypt, decrypt, sign, verify This program allows you to encrypt and decrypt raw files using RSA keys ...
user avatar
2 votes
0 answers
347 views

Time-based session management (module)

This is a project I've been working on and released on GitHub here. The purpose of the module is to provide sessions, which can be used in situations where access to sensitive data needs to be ...
user avatar
  • 4,492
2 votes
0 answers
79 views

Web Security with Authentication Key in Query String

What is the best way to authenticate using a key in a query string? I have a web service that clients can consume if they provide a authentication key in the query string. I also have a web front-...
user avatar
  • 151
2 votes
0 answers
918 views

Hashing a SecureString in C#

In .NET, the SecureString type exists to prevent leaking secrets in memory. I want to create a hash from the contents of a SecureString, without putting the contents in memory in a place where I can't ...
user avatar
  • 309
2 votes
0 answers
206 views

Locally encrypt/decrypt credentials

I wrote some code to encrypt and decrypt some user credentials for services that a locally run application needs to work. I get a password from the user, use it to stretch a key via Scrypt, and then ...
user avatar
  • 161
2 votes
0 answers
55 views

Function to prevent sign-in form from being spammed

I have written a function that I want to protect from spam bots. I have used two techniques the first being filter after submit. After reading around I obtained the ...
user avatar
  • 487
2 votes
0 answers
60 views

Signing timestamped API queries

The following code should prove to offer sufficient security for public API so my main concern is about design flaws in process. It is meant to describe the process and eventually get included in ...
user avatar
  • 131
2 votes
0 answers
251 views

Adds digital signature to outgoing TCP packet

The code connects multiple clients to a server using TCP sockets asynchronously. I have added code to attach a digital signature to the outgoing messages from the server, to authenticate the message ...
user avatar
  • 121
2 votes
0 answers
334 views

XSS Sanitization of RSS Feeds using JS

I need to pull an rss feed with links, headlines, and descriptions onto the front page of a website, and while I would like to think the source is trustworthy, you can never rule out malicious actors. ...
user avatar
  • 131
2 votes
0 answers
356 views

Sanitization and phpmailer security

I'm trying to set up a contact form using phpmailer. Are there any security holes in my code? I want to be sure as I feel there might be some kinda exploit I may not be aware of. ...
user avatar
2 votes
0 answers
51 views

CF/jQ server-side session struct to replace hidden inputs

I have inherited a legacy ColdFusion app with gobs of <input type="hidden"> fields, and a user finally may have used F12/Inspect Element to submit a ...
user avatar
  • 133
2 votes
0 answers
130 views

Unsafe Node.js code, though in a trusted environment

I am going to run a private Node.js app in a local network which will take user code submissions and evaluate them. Since it is a trusted environment (just friends), I have not bothered at all about ...
user avatar
  • 171
2 votes
0 answers
73 views

Application Class Security

Is my Application.php class secure for continuing development? The Application.php acts as a registry for the whole application. I tried not to rewrite already working code that is being pulled from ...
user avatar
  • 173
1 vote
0 answers
56 views

Password hashing for safe storage with Bcrypt

This code snippet implements password hashing for safe storage. It uses Bcrypt for the hashing algorithm. The method hash_password() is used to hash and salt a ...
user avatar
1 vote
0 answers
33 views

Verify implementing Microsoft Graph 4.0.0 for SSO in Azure is implemented correctly

I originally posted this on SO, and I know cross-linking is generally frowned upon. But, I am not sure if this falls under question or code review because the code works where I do not know if it is ...
user avatar
  • 131
1 vote
0 answers
27 views

Access to IIdentity outside of aspnet application

My ASP.NET application references a classlib that contains the business logic, where I need to have access to the IIdentity of the "current user". In ASP....
user avatar
  • 11
1 vote
0 answers
43 views

sanitize untrusted input for templates

Does this adequately sanitize untrusted input for client side frontend templating where templates are otherwise trusted? What details remain to address or need reconsidering? Please note the character ...
user avatar
  • 221
1 vote
0 answers
90 views

Securing React SPA with Azure AD B2C Tenant using MSAL

I am securing my React Apps and I want to use the wrapper function below to insure that the app only gets rendered when there is a successful login. I am separating the Login from future MSAL token ...
user avatar
  • 243
1 vote
0 answers
91 views

Getting around CORS error for displaying images on my website

I have my images stored in an S3 bucket and I am serving them from AWS CloudFront. I have created 2 CNAME records for the CloudFront: mywebsite.com and ...
user avatar
1 vote
0 answers
44 views

Functions to obfuscate and deobfuscate String. Am I missing out any edge cases?

I have 2 functions, which are going to hide/ unhide the multiple languages plain text. Security is not a major concern. The objectives are Just want to find a way to hide multiple ...
user avatar
1 vote
0 answers
43 views

Simple ruby program for AWS ruby SDK

I wrote a simple ruby program for interacting with one of my temporary AWS S3 using Ruby SDK. Below is the program I've written. Since I learned ruby by myself I need help/suggestions in following ...
user avatar
1 vote
0 answers
424 views

Using postMessage() in JavaScript with iframes for cross domain communication

I am trying to enable communication via JavaScript from an iframe and its parent window when they are on different domains. I did a lot of research and it turned out that ...
user avatar
1 vote
0 answers
71 views

Login/Register/Welcomepage/Updateuserprofile security improvements

I have created a Login, Register ,welcomepage(userprofile with updatefunction). I have done that without thinking about security. Now I would like to improve the security on these pages. Note: This ...
user avatar
1 vote
0 answers
18 views

Communication between privileged (function) and non-privileged (GUI) python script on macOS

Ok, so I am creating my own macOS cleaning app. Something like OnyX but then open-source and python based. The removal process requires administrative privileges but since I have read that it is ...
user avatar
  • 203