The tag has no usage guidance.

learn more… | top users | synonyms

0
votes
2answers
57 views

Can a website get user details if the site is using facebook account kit to log in?

Is it possible to for a website to get my number and email id if they are using facebook account kit to verify users without facebook accounts.And how to collect the user details accessing this ...
1
vote
1answer
57 views

Is opening a templating engine to users a bad idea?

My site allows users to create custom HTML templates for their profiles (very much like Tumblr and the theme system), and I picked the Twig template engine for the site. However, I'm not sure if it'...
0
votes
0answers
13 views

Proxied server requests + forwarding authentication info in a secure fashion

We are using PassportJS with a couple of Node.js servers - but we have some questions about how to use Passport with "proxy" requests. My main question is how do we (and should we at all) forward the ...
1
vote
2answers
226 views

Why are Strings in StringPool considered insecure?

Passwords are recommended to be stored in char[] instead of String, as Strings are stored in StringPool. Read more here As per this question Strings in StringPool are not available directly. To ...
59
votes
8answers
7k views

Securing sensitive data from developers

I have an enterprise application running that uses both MySQL and MongoDB datastores. My development team all have SSH access to the machine in order to perform application releases, maintenance, etc. ...
8
votes
1answer
249 views

Securely sending data from shared hosted PHP script to local MSSQL

I'm trying to add data from a webhook (from a web cart) to a local Microsoft SQL Server. It seems like the best route for me is to use a PHP script to listen for new data (POST as json), parse it, ...
4
votes
2answers
1k views

Where to Perform Authentication in REST API Server?

I am working on a set of REST APIs that needs to be secured so that only authenticated calls will be performed. There will be multiple web apps to service these APIs. Is there a best-practice approach ...
0
votes
2answers
256 views

Are random number generators security holes?

If I retrieve a random number from a database (e.g. RAND() in SQL Server) or using a programming language and send this in some form back to a client machine, is there an economic chance I will be ...
1
vote
2answers
186 views

How can I limit access for automatically generated files to specific users in a MVC setup?

I have a typical MVC based website, and I'd like to give some registered users the abillity to extract data from the database (in a variety of formats). The workflow is very simple: User logs in, ...
0
votes
1answer
768 views

WCF service and security

Been building a WP7 app and now I need it to communicate to a WCF service I made to make changes to an SQL database. I am a little concerned about security as the user name and password for accessing ...
1
vote
2answers
2k views

Why special characters are deemed risky in URL and query strings?

From a security perspective, the special characters like '&' or <b> are a big no no in URLs and query strings. I could find the articles that explained the ways to bypass this restriction, ...