Tagged Questions

2
votes
2answers
172 views

How can I keep a production Python environment secure?

Most of my work is creating websites in Django (a Python web framework) and deploying them to my own or clients' servers. I work from a virtualenv to separate site from system packages and have ...
36
votes
6answers
2k views

Logging failed login attempts exposes passwords

I started logging failed logins attempts on my website with a message like Failed login attempt by qntmfred I've noticed some of these logs look like Failed login attempt by qntmfredmypassword I'm ...
2
votes
3answers
256 views

Securely storing secret data in a client-side web application

I have this web application that is going to be all client-side technology (HTML, CSS, JavaScript/AngularJS, etc...). This web application is going to be interacting with REST API in order to access ...
0
votes
0answers
193 views

Connecting with OAuth, dealing with logout and browser sessions

I work on a open-source web application (Moodle) which connects to a number of external services such as Google Drive, Dropbox etc. to allow users to exchange files with these services. Primarily we ...
9
votes
7answers
309 views

Is the use of security conditionals in a view a violation of MVC?

Often what's displayed to a user (e.g. on a web page) will be based partly on security checks. I usually consider user-level / ACL security to be part of the business logic of a system. If a view ...
2
votes
4answers
352 views

What are the downsides of leaving automation tags in production code?

I've been setting up debug tags for automated testing of a GWT-based web application. This involves turning on custom debug id tags/attributes for elements in the source of the app. It's a non-trivial ...
-2
votes
3answers
195 views

How to handle security of temporary data on web server?

I'm primarily an ASP.NET developer but this question really applies regardless of language. So obviously it is a good idea to prevent external attacks that arise from session hijacking and csrf ...
0
votes
2answers
179 views

What is the logic behind filtering/sanitizing input?

I have always found it more logic to validate input instead of filtering it. How to appropriately filter data depends on the situation, so IMO it should be done in output or when saving to a database. ...
3
votes
1answer
119 views

File Upload Forms: Security

SO I'm building an application for uploading files. We're paying scientists to contribute information on pests, diseases and bugs (for Plants). We need the ability to drag and drop a file to upload ...
1
vote
1answer
488 views

How frequent should the Token Updation in CSRF security be?

To start with the background, this post is what Jeff Atwood says about CSRF tokens. In this very page, he goes on to say: An even stronger, albeit more complex, prevention method is to leverage ...
3
votes
2answers
466 views

Making sure database connection information is secured

This is the first time that I am working on a web application. I was going through the question What should every programmer know about web development? and noticed one thing that I knew nothing of: ...
-1
votes
1answer
579 views

python login form vulnerability?

<HTML> <HEAD><TITLE>Login Page</TITLE></HEAD> <BODY> <CENTER> <FORM method="POST" action="http://yourserver/cgi-bin/login.py"> <paragraph> Enter ...
4
votes
2answers
347 views

Is a traditional client app which connects directly to a database a good idea?

After using Django's excellent admin interface, I was pondering creating a similar system which wasn't as tied to an ORM. Now, while considering this, I thought that overcoming webapps limitations ...
11
votes
3answers
2k views

Is it a good practice set connection strings in a web config?

Recently I have a discussion with some of my colleagues at my work because they said that it's better have in a .DLL a string connection encrypted. And I said why just don't use the string connection ...
5
votes
6answers
935 views

How can I prevent users from creating multiple accounts on a web site?

I'm building a site that needs to guarantee user reputation scores are accurate by preventing users from creating more than one account, at the cost of decreased user signups. So far, the only ...
3
votes
2answers
225 views

Why should you prevent a search engine from indexing your development server?

I've heard that you shouldn't let search engines index your development server. The reasons given were: Duplicate content penalties Customers making purchases from an unsecured domain (if ...
2
votes
3answers
160 views

Guidelines for a “medium security” site?

I'm designing a site that needs to be secured, but won't host any PII or other highly sensitive information. It's also going to be accessed relatively infrequently so I don't want an onerous ...
2
votes
5answers
387 views

Hiring Developers - Securing Source Code

I have a popular web-based app, and now suddenly my main developer has disappeared. Although I've found other great developers but I don't want to distribute the source code to everyone. Is there any ...
2
votes
1answer
337 views

Web security course?

I'd like to do a course about web security. I've seen some certifications that could be interesting: CIW Web Security Professional CISSP® - Certified Information Systems Security Professional ...
20
votes
3answers
1k views

Should MVC/REST return a 403 or 404 for resources belonging to other users?

When working with a resource-based site (such as an MVC application or REST service), we have two main options when a client tries to GET a resource that they don't have access to: 403, which says ...
15
votes
5answers
4k views

What best practices should be employed in a PHP login script?

I am wanting to re-write my login scripts for clients websites to make them more secure. I want to know what best practices I can implement into this. Password protected control panels are in their ...
1
vote
8answers
500 views

My very first serious project and I'm concerned about security

I'm making a small social networking web site for a specific university's students (where I study) and I'm concerned about security (access to the database). What should I do? What I have to check for ...
6
votes
1answer
2k views

Software architecture for authentication/access-control of REST web service

I am setting up a new RESTful web service and I need to provide a role-based access control model. I need to create an architecture that will allow users to provide their username and password to get ...
13
votes
7answers
1k views

stackoverflow induced passivity - how to cope?

After not really working on my pet project for a while, I discovered Stackoverflow and upon perusing it more intensely I was quite amazed. I'm a bit of a perfectionist, so when I found eye-openers ...
2
votes
4answers
235 views

How did you learn about security in your web development?

I've been developing intranet web sites and public web sites with no big issues concerning security. There were nothing to steal and nothing to gain. Nothing to attract people to try to reach the ...
6
votes
7answers
722 views

How to make security usable in a web application?

I'm in the planning stages of developing a web application that I want to make as secure as possible. I'm pretty clear about how to do that from a technical point of view, but there is one massive ...