0
votes
1answer
101 views

Do we have any special design considerations for maintaining anonymity in an application?

This is an open-ended question which I am analysing while doing some fun projects in leisure. Websites like Google, Facebook do store user activities and perhaps sell them or use them for ...
1
vote
1answer
289 views

Is it an implementation of a stateful mechanism for Rest API authentication?

In many articles about Rest API's best practices, it is recommended to not depend upon sessions on server side since it leads to a stateful mechanism. I currently use Play 2.2 framework, with a ...
2
votes
2answers
160 views

Principles of an extensible data proxy

There is a growing industry now with more than 30 companies playing in the Backend-As-A-Service (BaaS) market. The principle is simple: give companies a secure way of exposing data housed on premises ...
1
vote
0answers
133 views

How to securely store user credentials from external website

I'm developing an application where I'd like to use credentials from external websites. This will be used to login with the website API and get information for the user. Example: I want to use the ...
28
votes
1answer
912 views

If the spec is flawed, should it still be followed?

I have been assigned to develop an integration to one of my employer's applications to an external system developed by our client. Our client's specification for the integration that has some blatant ...
4
votes
2answers
401 views

Where to Perform Authentication in REST API Server?

I am working on a set of REST APIs that needs to be secured so that only authenticated calls will be performed. There will be multiple web apps to service these APIs. Is there a best-practice approach ...
2
votes
3answers
490 views

Is there a better way of handling access control logic instead of it being in the UI?

Through most of my dev experience, I've never had to deal with much variety of access control architectures. They've all been pretty straight forward: Group [Create, Update, Delete] - User 1 ...
0
votes
4answers
214 views

Are security exploits a fatality? [closed]

I'm asking this here and not on the security related site because this one is a question about "software architecture" and "development methodologies", which are both covered by the FAQ. EDIT: I'm ...
3
votes
1answer
202 views

Building dedicated codepad in PHP

I am author of growing framework, which is focused around User Interface building in PHP. Essential requirements for the up-coming website redesign is ability to run code examples. I am willing to ...
1
vote
1answer
82 views

Securely changing system configuration from a web application

I need to write a web application that acts as a configuration interface for some system services. Meaning it will probably change some kind of configuration file and has to restart (linux) system ...
38
votes
11answers
3k views

Is there any reason not to go directly from client-side Javascript to a database? [duplicate]

Possible Duplicate: Writing Web “server less” applications So, let's say I'm going to build a Stack Exchange clone and I decide to use something like CouchDB as my backend store. If I use ...
3
votes
3answers
518 views

Securing credentials passed to web service

I'm attempting to design a single sign on system for use in a distributed architecture. Specifically, I must provide a way for a client website (that is, a website on a different ...
4
votes
2answers
492 views

Should I be using a JavaScript SPA designed when security is important

I asked something kind of similar on stackoverflow with a particular piece of code however I want to try to ask this in a broader sense. So I have this web application that I have started to write in ...
3
votes
4answers
514 views

Public-private key pair handling on a Windows ecosystem

I've been thinking about how to architect an infrastructure for one of our business applications with the following requirement: Data written by some user can only be read by that user and his ...
0
votes
1answer
162 views

Security aspects of an ASP.NET that can be pointed out to the client

I need to write several passages of text in an offer to the client about the security layer in ASP.NET MVC web solution. I am aware of security that comes along with MVC 3 and an improvements in MVC ...