1
vote
2answers
95 views

How do I / what is the best way to interact with a desktop application from a browser web application?

Situation: We have a desktop application. We also have a web application. We need the two to interact with each other. So when a button is pushed in the web application, the desktop application ...
0
votes
1answer
98 views

secure offline PC storage accessible through javascript

I'm attempting to build a browser-based HTML5 application that has the ability to store data locally on a PC (not mobile device) when offline. This data is sensitive and must be secure. Of course the ...
2
votes
1answer
171 views

How to check for vulnerabilities in web application [closed]

I have developed a web application using zend framework, mysql, and other client side technologies like javascript, jquery ajax, kendo grid, and so on. I have completed development and have done ...
1
vote
2answers
108 views

How can I limit access for automatically generated files to specific users in a MVC setup?

I have a typical MVC based website, and I'd like to give some registered users the abillity to extract data from the database (in a variety of formats). The workflow is very simple: User logs in, ...
1
vote
3answers
165 views

Protect Images in a Webpage

I want to build a website that will contain a lot of images. I don't want users who visit the website to be able to save the images. I have blocked the right click option, but is there any other ...
0
votes
0answers
23 views

Login to a Web App using PKI Certs [duplicate]

I understand PKI reasonably well from a conceptual point of view - i.e. private keys/public keys - the math behind them, use of hash & encryption to sign a certificate, Digital Signing of ...
6
votes
1answer
578 views

Implementing Digitally signed data in a Web Application

I understand PKI well from a conceptual point of view - i.e. private keys/public keys - the math behind them, use of hash & encryption to sign a certificate, Digital Signing of Transactions or ...
6
votes
3answers
237 views

How will writing the transaction part in Java benefit the security of the application, when all other parts are being written in PHP?

A friend of mine while working on a PHP application asked me to write one part of the application in Java. The part that involved transactions. He said it will be better to write this portion in Java. ...
3
votes
1answer
405 views

Using a public username as a login username

It has just dawned on me, that a system I am developing exposes a users username in the URI. This is a problem, since some of the users pages are public. Therefore people will know their username. I ...
1
vote
1answer
84 views

Securely changing system configuration from a web application

I need to write a web application that acts as a configuration interface for some system services. Meaning it will probably change some kind of configuration file and has to restart (linux) system ...
3
votes
1answer
352 views

J2EE - Field level Role-based security for a complete web application [closed]

I have a complex website designed using Spring MVC and MyBatis. User Interface is very complex and we have lot of custom made widgets - calenders, lists, graphs etc. If we were to implement field ...
2
votes
2answers
247 views

Drop in service for account management, authentication, identity?

I'm building an Android app and associated set of web services for uploading/downloading data. I need a basic (no frills) solution for account management (register, login, logout, verify ...
9
votes
2answers
817 views

How do CDNs protect failover sites from DDoS attacks?

I'm in the design process for a Java web app that I will probably end up deploying to Google App Engine (GAE). The nice thing about GAE is that I really don't have to worry about fortifying my app ...
5
votes
5answers
2k views

What is the rationale behind entering email twice for registration? [duplicate]

Many web sites ask users to enter their email address twice, sometimes taking the trouble to disable copy-pasting. What is the logic behind this? Is this e.g. a security measure?
0
votes
5answers
661 views

Standards & compliances for secure web application development?

I am working with developers right now that write code the way they want and when i tell them to do it other way they respond that its just matter of preference how to do it and they have their way ...
2
votes
2answers
110 views

Security of logging people in automatically from another app?

I have 2 apps. They both have accounts, and each account has users. These apps are going to share the same users and accounts and they will always be in sync. I want to be able to login ...
9
votes
7answers
4k views

Is obscuring/obfuscating public-facing database ids really a “best practice”?

I've heard people lecture here and there on the internet that it's best practice to obscure public facing database ids in web applications. I suppose they mainly mean in forms and in urls, but I've ...
4
votes
1answer
302 views

What was the earliest use of cryptographic tokens in URLs?

I was wondering: it now seems to be more and more common to see people/framework putting cryptographic tokens in the URLs their webapps are generating (to prevent quite effectively against quite some ...
27
votes
3answers
2k views

Should MVC/REST return a 403 or 404 for resources belonging to other users?

When working with a resource-based site (such as an MVC application or REST service), we have two main options when a client tries to GET a resource that they don't have access to: 403, which says ...
10
votes
5answers
6k views

Best practices for web application Authentication/Security (Any Platform)

I got a question today from my manager asking me my thoughts on what is considered an acceptable design for authentication of a web form application, especially in regards to the nature of many ...