For questions relating to cryptography and IT security. This can be computer, network, or database security.

learn more… | top users | synonyms

1
vote
2answers
151 views

Hide admin menu if no admin option is available

If you have a menu "Admin tasks" and different admin tasks (like 10) that you could separately assign to each user, but there are users who don't have any admin tasks, how would you deal with "Hiding ...
0
votes
2answers
229 views

Database Handler and SQL injection prevention

I've written a database model class in PHP and have written a controller class that specifically validates the data before sending it to db. I'm getting criticism that I should handle the data in ...
1
vote
1answer
297 views

Should I hide certain HTTP status codes?

So I have different seniors taking different positions on this. Some saying hide nothing, those codes are there for a reason. Others saying to hide most status codes, reducing the number to a much ...
0
votes
1answer
64 views

Periodically polling an API, are there alternatives?

I'm currently working on a service that is supposed to aggregate data from a number of APIs, unify the data, and offer it through another API to the users. I had a couple of ideas for solving this, ...
1
vote
0answers
71 views

How to limit users of a service to a specific program

I have built an android game - I would like to add a "high score" leaderboard to it, such that people can show off how high they managed to score. How should I design it so that people can't "hack" it ...
1
vote
0answers
71 views

Handling permissions in a MVP application

In a windows forms payroll application employing MVP pattern (for a small scale client) I'm planing user permission handling as follows (permission based) as basically its implementation should be ...
1
vote
0answers
136 views

How to securely store user credentials from external website

I'm developing an application where I'd like to use credentials from external websites. This will be used to login with the website API and get information for the user. Example: I want to use the ...
1
vote
0answers
84 views

Switching between Azure Mobile Services vs my own implementation. Will UIDs change?

I'm looking at Azure Mobile Services, particularly the Authentication part (which I believe relies exclusively on OAUTH 1 or 2). I want to make sure that my application isn't tightly coupled to the ...
1
vote
0answers
640 views

Connecting with OAuth, dealing with logout and browser sessions

I work on a open-source web application (Moodle) which connects to a number of external services such as Google Drive, Dropbox etc. to allow users to exchange files with these services. Primarily we ...
0
votes
0answers
83 views

Row and Field level Security Management through Code First EF, WebApi2

I could not find such question specific to asp.net webapi row level security on SO. I am building an API through .NET Webapi2 with Entity Framework. I am trying to assess various options that are ...
0
votes
0answers
15 views

Storing a WCF endpoint in the registry - worried about security

I am storing my wcf endpoint in the registry, and using that whenever my app starts up to instantiate a wcf derived object. The user can change the endpoint location, to another server, and the ...
0
votes
0answers
229 views

Best practice: Secure Android app online authentication

Currently, I develop an Android App needing online authentication for login (and registration). The main focus is on security. I’m amaing for: keeping the users’ passwords safe and preventing MITM ...
0
votes
0answers
72 views

Security in Transversal Layer in Domain Driven Design

I'm building a solution based on Domain Driven Design, I'm trying to implement the security system (authentication, authorization, roles, system configuration, connection strings, etc..) in a ...
0
votes
0answers
56 views

How to validate information on server without using database or session

Each user has multiple sites they can access reporting data for in an application I am working on. To prevent having to go to the database on every single request, I validate that they have access to ...
0
votes
0answers
63 views

Token based autorization for a web game

I am lead developer for a multiplayer game in a small startup company. I would like to present here my solution for token based authentication and hear your opinions about possible weak spots. I am ...
0
votes
0answers
39 views

Online error reporting without network access

I have developed an application for android requiring no permissions, but the biggest downside of this is that I don't have error reporting. So, I was playing around for the past week with any ...
0
votes
0answers
29 views

Domain security involving domain logic

Together with my application's domain logic I am trying to outline the security model. I am stuck with a requirement that prevents me from considering security just a cross-cutting concern over my ...
0
votes
0answers
110 views

Is my application secure enough

first of all, I don't have any code to display in my question here, because I'm still designing the application structure, so i only got design developed. I'm building a phone application that I'm ...
0
votes
0answers
52 views

Validating time-limited HMACs

I'm exploring using HMAC style secret-key authentication with timestamp expiry, but am struggling to get my head around how you validate the timestamp portion. On the client side you would do: ...
0
votes
0answers
1k views

How secure is this way of authenticating an ASP .NET Web API - creating your own tokens?

http://www.codeproject.com/Articles/630986/Cross-Platform-Authentication-With-ASP-NET-Web-API#_rating The above link shows exactly how I want to go about authenticating against an ASP .NET Web API. ...
-3
votes
0answers
41 views

How to protect a private REST API in an javascript web application

I'm building a web application. It's basically a blog. There is a javascript client web application and there is a server that implements REST API. When user visits my blog, I use javascript ...