Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [security]

Computer security is security applied to computing devices such as computers and smartphones, as well as to both private and public computer networks, including the whole Internet.

47 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
16 votes
0 answers
858 views

Let's register that Django user

Short intro So, I've been using Django for a while now and thought it would be nice to start a simple application. In an ideal World, each app must have a way of letting its users register and that's ...
Grajdeanu Alex's user avatar
6 votes
0 answers
483 views

Bash script for pull-mode backups via restic's rest-server

I wrote the following Bash scripts to make pull-mode backups with restic, a backup solution written in Golang, similar to Borg Backup. The main use case for this script is pulling backups into a ...
andrew-e's user avatar
  • 353
5 votes
0 answers
2k views

Secure Password and Passphrase Generator in Python 3

I'm aware that people have implemented password/passphrase generators before, but I still went ahead and wrote my own, which I actually use for my own passwords and/or phrases. By "secure", I mean ...
code_dredd's user avatar
4 votes
0 answers
67 views

Serving Laravel public/ contents when all Laravel files are in the same server directory

I have a Laravel 8 project hosted at xxx/laravel/ on an Apache server, where xxx is the domain. I want to serve the contents of <...
Ichi's user avatar
  • 93
4 votes
0 answers
3k views

Reactive JWT authentication using Spring webflux

Greeting to all senior devs here. I'm trying to create a project for my small business. There are not many tutorial on how to create Reactive JWT authentication with Spring webflux. So I'm a bit ...
Patrick's user avatar
  • 331
4 votes
0 answers
127 views

Securely generate Token for authentication

In my experience i had the need that some application (both desktop and web) can excange data to authenticate users (even if the data for authenticating users are not reacheable form desktop ...
Skary's user avatar
  • 248
4 votes
0 answers
747 views

Clear-net browsing with Lynx over Tor

This project is designed to enable clear-net browsing over the Tor network with the Lynx web-browser. Currently everything seems to be functioning as intended, however, it would be most appreciated if ...
S0AndS0's user avatar
  • 976
4 votes
0 answers
148 views

Automatically encrypting text editor

I have written an automatically encrypting text editor (github link). The reasons that I wrote this program instead of using vim + gpg are: It's more convenient than vim + gpg (user only needs to ...
1f604's user avatar
  • 41
4 votes
0 answers
130 views

(de-)serializer for arbitrary python objects

My program is intended to allow (de-)serialization of arbitrary Python objects. It's basically a replacement for python's pickle module, which is similar but prone ...
Aran-Fey's user avatar
  • 143
4 votes
0 answers
8k views

OpenSSL Client/Server

I have recently begun to dabble with OpenSSL to provide TLS encryption to TCP socket communication. Through documentation and heavy reference on example code I have come up with the following code (...
chadduffin's user avatar
4 votes
0 answers
837 views

OAuth 2.0 implicit flow implementation

I have been implementing the OAuth 2.0 implicit flow to secure the API I use in an Angular SAP. Please, could you review my code? I am sure there is a lot of stuff to improve in it. I have separated ...
BodzioSamolot's user avatar
3 votes
0 answers
27 views

Using Pundit Policy Scopes with Searchkick Results

We are using Searchkick to run our elasticsearch and Pundit to authorize users for specific actions. Below is our module SearchkickScope that does it's best to ...
Romuloux's user avatar
3 votes
0 answers
186 views

Simple websocket chat app

I'm coding a simple websocket chat app. I was wondering if my code is secure and efficient. I also have a question about the way how I'm sending objects and then checking the type, is there anything ...
MousTea's user avatar
  • 31
3 votes
0 answers
430 views

Creating SQL Server Database Users Dynamically from User Input

The Application I have an application in testing that runs off of an MS SQL Server database. The app allows users to authenticate using Windows authentication (that is, using the Windows username the ...
Keith Stein's user avatar
3 votes
0 answers
78 views

.htaccess file to enable compression, send security headers, and set cache expiration

This is the current .htaccess configuration for one of the website projects that I am working on, just as a learning exercise. This is working code and everything ...
Ryan Stone's user avatar
3 votes
0 answers
520 views

Codeigniter 3 loading models in a different way

I'm currently building an application that uses the same models in different controllers. Instead of using the normal way, being loading the model in the controller I've build a "core controller" (<...
Bart's user avatar
  • 31
3 votes
0 answers
93 views

Implementing secure API for use between other internal apps

My team and I are trying to implement a secure API and would appreciate some feedback on the following: If there are areas of improvement in the current code to improve security Recommendations on ...
Kay E's user avatar
  • 31
3 votes
0 answers
2k views

File encryption/decryption in Python

How secure is this Python code? Can there be any attacks on this encryption? I tried to follow all the rules that I could find: KDF instead of hash, EAX (authenticated encryption mode) and other. <...
Ranx's user avatar
  • 31
3 votes
0 answers
600 views

Python Keylogger

Just a simple utility that logs the pressed keys in Python and takes a screenshot everytime a new PID is opened. Ì got bored at work, so decided I was going to have some fun with this. Made in ...
Ludisposed's user avatar
  • 11.6k
3 votes
0 answers
1k views

Hashing a SecureString in C#

In .NET, the SecureString type exists to prevent leaking secrets in memory. I want to create a hash from the contents of a SecureString, without putting the contents in memory in a place where I can't ...
Sjoerd's user avatar
  • 319
3 votes
0 answers
67 views

PL/pgSQL autologin token generation

Here's an excerpt from my migration script for my database for the new "remember me" login option for my web application. Logging in with a valid username/password combination (authenticate_user) ...
cimmanon's user avatar
  • 3,654
3 votes
0 answers
298 views

Streamed encrypt then MAC construction

I've been porting python Keyczar to work under 2to3 conversion (Github). I wanted to consolidate its streaming AES encrypt/decrypt backend interface with its string decrypt/encrypt. So I wrote a new ...
jbtule's user avatar
  • 341
2 votes
0 answers
74 views

Basic flask template with sessions

This Flask app, which makes use of SQLAlchemy, a MySQL server which is only reachable via SSH and Flask-Login, is the base on which I want to write an application which has login protected pages. ...
Woask's user avatar
  • 125
2 votes
0 answers
84 views

JWT authentication system login through API

This is my first time writing an authentication system. Here's how it works, first client needs to send credential within authorization header like { Authorization : 'Basic ' + credential } through ...
Patrick's user avatar
  • 331
2 votes
0 answers
305 views

Production ready user signup, login and logout using python and tornado

Please review my code with the following in mind: Does anyone see a reason to make this asynchronous, why would i do that? How do i work out the maximum number of users it can handle at one time? at ...
Felix Farquharson's user avatar
2 votes
0 answers
101 views

Structure and Code of Tornado WebAPP

I wrote a test application to familiarize myself with the Tornado Python framework. The application currently generates a cookie that you can view and delete. I ...
Michail Vizarkovyc's user avatar
2 votes
0 answers
108 views

CSRF script in Php

A short script to make a CSRF token to be used in my html elements such as inputs, file-uploads, scripts, iframes & svgs. ...
Ryan Stone's user avatar
2 votes
0 answers
158 views

WordPress rest api basic auth with IP check

I'd like to use basic auth with the WordPress API, but restrict the capability to a single IP address. I've updated the existing code from here: https://github.com/WP-API/Basic-Auth accordingly. It ...
nzt's user avatar
  • 121
2 votes
0 answers
43 views

Custom Security for API access from server to mobile application

i am not the best at security but need a custom way to securely store personal identifiable information like name, address etc - Can i please have some feedback on this custom code, from my ...
Im a Developer's user avatar
2 votes
0 answers
243 views

Django authentication against Exchange server

I wrote an authentication app for Django and my worry is primarily about the security of my app. My Django authentication app uses exchangelib to authenticate ...
Greg Schmit's user avatar
2 votes
0 answers
737 views

Python RSA/DSA File Cryptography, Key Generation, Key Protection

I have forked a previous version of my script, critiqued here: Generate public/private keys, encrypt, decrypt, sign, verify This program allows you to encrypt and decrypt raw files using RSA keys ...
FodderOverflow's user avatar
2 votes
0 answers
81 views

Web Security with Authentication Key in Query String

What is the best way to authenticate using a key in a query string? I have a web service that clients can consume if they provide a authentication key in the query string. I also have a web front-...
Steve3p0's user avatar
  • 151
2 votes
0 answers
218 views

Locally encrypt/decrypt credentials

I wrote some code to encrypt and decrypt some user credentials for services that a locally run application needs to work. I get a password from the user, use it to stretch a key via Scrypt, and then ...
berdario's user avatar
  • 161
2 votes
0 answers
58 views

Function to prevent sign-in form from being spammed

I have written a function that I want to protect from spam bots. I have used two techniques the first being filter after submit. After reading around I obtained the ...
mp252's user avatar
  • 497
2 votes
0 answers
66 views

Signing timestamped API queries

The following code should prove to offer sufficient security for public API so my main concern is about design flaws in process. It is meant to describe the process and eventually get included in ...
michelek's user avatar
  • 131
2 votes
0 answers
322 views

Adds digital signature to outgoing TCP packet

The code connects multiple clients to a server using TCP sockets asynchronously. I have added code to attach a digital signature to the outgoing messages from the server, to authenticate the message ...
DafyddNZ's user avatar
  • 121
2 votes
0 answers
381 views

XSS Sanitization of RSS Feeds using JS

I need to pull an rss feed with links, headlines, and descriptions onto the front page of a website, and while I would like to think the source is trustworthy, you can never rule out malicious actors. ...
Emmett R.'s user avatar
  • 129
2 votes
0 answers
426 views

Sanitization and phpmailer security

I'm trying to set up a contact form using phpmailer. Are there any security holes in my code? I want to be sure as I feel there might be some kinda exploit I may not be aware of. ...
xmunchaser's user avatar
2 votes
0 answers
56 views

CF/jQ server-side session struct to replace hidden inputs

I have inherited a legacy ColdFusion app with gobs of <input type="hidden"> fields, and a user finally may have used F12/Inspect Element to submit a ...
gordon's user avatar
  • 133
2 votes
0 answers
134 views

Unsafe Node.js code, though in a trusted environment

I am going to run a private Node.js app in a local network which will take user code submissions and evaluate them. Since it is a trusted environment (just friends), I have not bothered at all about ...
duci9y's user avatar
  • 171
2 votes
0 answers
77 views

Application Class Security

Is my Application.php class secure for continuing development? The Application.php acts as a registry for the whole application. I tried not to rewrite already working code that is being pulled from ...
Traven's user avatar
  • 173
1 vote
0 answers
123 views

Modified PoC for BlogEngine.NET CMS (CVE-2019-6714)

This is a modified exploit proof of concept targeting the BlogEngine.NET content management system (CVE-2019-6714) for the .NET framework. I modified it (from Cobb 2019) to execute payloads via ...
Aleksey's user avatar
  • 173
1 vote
0 answers
2k views

Pay with PayPal through cURL and verify

As All PayPal PHP SDK deprecated, I wrote a simple PHP class to make payment with PayPal through cURL and verifying it. Note : I didn't add shipment details for payment because didn't need that. For ...
Kranchi's user avatar
  • 111
1 vote
0 answers
54 views

Functions to obfuscate and deobfuscate String. Am I missing out any edge cases?

I have 2 functions, which are going to hide/ unhide the multiple languages plain text. Security is not a major concern. The objectives are Just want to find a way to hide multiple ...
Cheok Yan Cheng's user avatar
1 vote
0 answers
352 views

Time-based session management (module)

This is a project I've been working on and released on GitHub here. The purpose of the module is to provide sessions, which can be used in situations where access to sensitive data needs to be ...
Daniel's user avatar
  • 4,490
1 vote
0 answers
1k views

Generating ssh keys from asp.net core

I have started to create a console app, which I am testing locally on my mac. The idea is to generate an ssh key and structure the storage of these keys within the ...
SJC's user avatar
  • 241
0 votes
0 answers
47 views

Securing microservices with Spring Security JWT

I would like to build a RESTful microservices architecture where each microservice acts as a resource server. Additionally, there will be an authorization server responsible only for user registration,...
yaroslav96's user avatar