0
votes
2answers
201 views

Is JavaScript safe? [closed]

My company has been developing a site for a very large company. The site is now live, and it has received its fair share of hits. The site relies enough on JavaScript to make far less aesthetically ...
0
votes
0answers
54 views

Token based autorization for a web game

I am lead developer for a multiplayer game in a small startup company. I would like to present here my solution for token based authentication and hear your opinions about possible weak spots. I am ...
-1
votes
2answers
228 views

Whats the best way to build a HTML/AJAX site that requires login? [closed]

Let's say that hypothetically you wanted to build a website that delivered content to the visitors entirely using HTML and Javascript (AJAX to fetch server side data). The site would require login for ...
-1
votes
1answer
127 views

Prevent 3D model from being copied [closed]

So I have been messing around with thingiview since I wanted to have a 3D viewer for the models on my site. It works great and everything except one problem. It's nothing wrong with thingiview, it is ...
0
votes
1answer
140 views

Browser security and payments

I've been finding a lot of blog posts claiming JS encryption is unsafe, here's a couple of detailed ones: http://www.matasano.com/articles/javascript-cryptography/ ...
0
votes
1answer
126 views

What are security advantages of Google Caja over using the web worker API? [closed]

I am currently looking into Google Caja to run user-supplied JS code in the browser and in Node. So far, I understand, that, in a browser context, "cajoled code" disallows reading and messing with ...
2
votes
5answers
258 views

secure photos on server [closed]

I would like to hear advice from the more experienced developers. The project is now in the design stage. It's mobile application and a simple web application. Content is pictures, comments, personal ...
0
votes
2answers
140 views

How can I solve this potential security exploit (concerning the saving of REST resources)?

I have a File database table with the following columns: Id (PK), Filename And a Document database table with the following columns: Id (PK), Name, Description, FileId (FK) When a user wants to ...
1
vote
1answer
136 views

Creating deterministic key pairs in javascript for use in encrypting/decrypting/signing messages

So I have been searching everywhere and havn't been able to find anything with the sufficient information I need.. so Im a bit stumped on this one at the moment What I am trying to do is create a ...
1
vote
3answers
165 views

Protect Images in a Webpage

I want to build a website that will contain a lot of images. I don't want users who visit the website to be able to save the images. I have blocked the right click option, but is there any other ...
31
votes
5answers
6k views

How easy is it to hack JavaScript (in a browser)?

My question has to do with JavaScript security. Imagine an authentication system where you're using a JavaScript framework like Backbone or AngularJS, and you need secure endpoints. That's not a ...
6
votes
2answers
2k views

Security in Authentication in single page apps

What's the most secure method of performing authentication in a single paged apps? I'm not talking about any specific client-side or server-side frameworks, but just general guidelines or best ...
2
votes
1answer
252 views

How to verify data from localStorage on a server

On my mobile app, I am storing the username of a logged in person, and downloading some data for the given/stored username. When the user checks for updates to his data content on the server, the ...
39
votes
11answers
3k views

Is there any reason not to go directly from client-side Javascript to a database? [duplicate]

Possible Duplicate: Writing Web “server less” applications So, let's say I'm going to build a Stack Exchange clone and I decide to use something like CouchDB as my backend store. If I use ...
1
vote
1answer
814 views

Is the escaping provided by the Google-Gson library enough to ensure a safe JSON payload?

I am currently using the Google-Gson library to convert Java objects into JSON inside a web service. Once the object has been converted to JSON, it is returned to the client to be converted into a ...
4
votes
1answer
159 views

How secure (or insecure) is it to install Node packages globally?

Should I be concerned with security when installing Node packages globally? Why or why not?
5
votes
2answers
540 views

Should I be using a JavaScript SPA designed when security is important

I asked something kind of similar on stackoverflow with a particular piece of code however I want to try to ask this in a broader sense. So I have this web application that I have started to write in ...
4
votes
1answer
1k views

How can we protect the namespace of an object in Javascript?

Continuing from my previous question: Javascript simple code to understand prototype-based OOP basics Let's say we run into console this two separate objects(even if they are called child and parent ...
1
vote
1answer
343 views

Javascript: Safely upload a client data file

I'm (still) working on a template-based XML editing program. It's a GUI-based XML editor that only allows users to add certain tags and attributes based off the requirements. You can see the current ...
1
vote
2answers
643 views

Securing client->database game

OK, I am creating a game using JavaScript and HTML5. The variables such as map, x, y, level, exp, etc are stored in JavaScript to keep track. On my client page, the JavaScript variables are stored to ...
2
votes
2answers
620 views

Provide a URL to a CouchDB document attachment without giving the username/password?

I posted this question on DBA, but it got closed and was never reopened even after I rewrote the whole thing to be more specific. I think its more appropriate for programmers anyway :) Background ...
5
votes
1answer
872 views

Means for (legit) cross-site scripting

Are there good means for allowing scripts from two or more domains to collaborate in the same browser page? I want to create an extensible platform, where I provide the model and some views, but also ...
2
votes
1answer
1k views

Why hasn't Caja been popular? [closed]

Google released Caja around 2008(Capability JavaScript). It is still mainly a laboratory language. But XSS and other attacks would be prevented if there was widespread integration of Caja.
-3
votes
1answer
585 views

How is JavaScript insecure, and what are the main methods used to deal with that? [closed]

I just read about Caja, which is a "sanitized" version of JavaScript. But I'm wondering - what is the big problem with JavaScript(it seems so widely used )? Just how dangerous is it?
20
votes
8answers
16k views

Why almost no webpages hash passwords in the client before submitting (and hashing them again on the server), as to “protect” against password reuse?

Relevant XKCD There are many sites on the Internet that require login information, and the only way to protect against password reusing is the "promise" that the passwords are hashed on the server, ...
16
votes
7answers
11k views

How secure is localstorage?

The question says it all really. I want to provide a service but I do not want to store any of the data myself in a database. With all the recent news of hacking etc it seems to me that it is nicer ...
3
votes
1answer
2k views

How to generate nonce for Ajax web requests

As many of you know WordPress uses "secret key" like thing for every AJAX request. Making each request unique and also 'somewhat' secure (just a step ahead than nothing). How would I implement the ...
0
votes
2answers
158 views

Why don't browsers have the ability to differentiate between events triggered via input devices and scripts ex: element.onEvent()?

Why don't browsers have the ability to differentiate between events triggered via input devices and scripts ex: element.onEvent()? Wouldn't this be a very simple way counter attack web spam bots? Or ...