Tag Info

New answers tagged

1

Looking at the source from a results page, the image thumbnails are not being fetched from other sites, but rather being served as base64 encoded data. Expanding the images does load them from their real address, but that does cause the https icon to turn grey (at least in the most recent version of chrome).


1

If you inspect the images with devtools, you will see that they don't use external urls, but instead use base64 encoded data uri's as the image source:


1

From what I understand, the token is to be verified upon each request to the resource server. This means the resource server would need to retrieve the token from a datastore to verify the clients token. Given this would have to happen upon every request I am concerned about the speed implications of hitting a datastore like MySQL or NoSQL upon ...


7

Can I somehow protect any application against piracy? Is it even theoretically possible? No, and it's a complete waste of time and effort to even try. When Microsoft's new OSes have cracked versions available before release day, and they put more R&D money into just that one feature than you'll ever see in your whole life, that should give you a ...


2

As per comments: If some or all of your sources have gone public - it's not the end of the world. Some companies operate on a semi-open software basis, where parts of the software are open, and some are proprietary. Your main protection should be legal. Any software will be pirated, independent of the amount of protection on source code, if it is deemed ...


0

If your database class is responsible for getting data into and out of your actual database, then it should take care of defending against SQL injection attacks or, if you're still building dynamic SQL, escaping character sequences that can be harmful (e.g. single quotes, line breaks (in some cases), etc.). That way, everything outside of the database ...


0

Your database validations should happen in your model. Assuming you are not using a framework you can write a generic wrapper class with your CRUD operations and protect against SQL injection etc. here. Data validation can occur within your wrapper and more specific validation (e.g. like Rails like validates_presence_of) on data can occur in models that ...


0

The problem with authorization checks only on the client side is that ultimately an attacker can mimick the behaviour of your application. Robert Harvey argues that it's unlikely for your users to debug the compiled application or to look at the network traffic. It very well may be. The problem is that it's not rocket science to find out what's going on. ...


1

Firstly, you should sign the assembly so users cannot tamper with it - Microsoft signs and secures its assemblies in the GAC to prevent hackers tampering with them. You should do the same. That prevents someone from modifying your assembly using some binary editor, though you will also have to cater for them replacing your assembly completely. Ensure you ...


3

Add a limit per ip / browser as a start and also a slowdown for the whole site. So if you get more > 150% of the normale amount of requests (in total) add a time limit which stops the requests. Let the user wait until the next minute for example. That will stop it. http://stackoverflow.com/questions/12449538/http-response-code-for-please-wait-a-little-bit ...


3

Authorization in an internal client/server application is a different beast than authorization in a web application on the Internet. In a web application, anyone can View/Source or start up Firebug, observe what's going on in your client, and even make changes to application state. That's why we always regard client-side validation as a convenience, and do ...


1

I'm not entirely sure I've understood correctly, but I think you can reduce your 7 database accesses to 1. Encode each security level as a bit in an integer. Store the security level with each record. Establish which security levels a user is allowed to see - encode this as a similar integer. When searching for records, include a requirement that the ...


1

If I understand correctly, previously the search results from the engine was fast. Now you do that, but additionally filter the results afterwards with up to 7 DB queries and intersection filters. Obviously, the problem lies with the DB queries, or the intersection sorting and filtering! The next question is - which is slow? Is the DB a slow box, are you ...


1

SSH keys are usually better than passwords because: You can configure a different key for different scenarios, e.g. for different client machines or different applications. If one becomes compromised, you can remove that key from the server but clients using the other key will continue functioning normally. With a password, you only have one, so you can't ...



Top 50 recent answers are included