nonce

CSRF tokens vs Nonce confusion - are they the same?

由 佐手、 提交于 2019-11-30 11:58:11
In a attempt to make the current application I'm developing more secure, I've been reading about CSRF tokens and also Nonce. My question simply is, Are CSRF tokens and Nonce the same thing? from what I could gather so far is that both these methods have different techniques to accomplish the same goal, or am I misunderstanding something? If they are different, could you be nice enough to provide some example code or point me to some links where i can learn more about how to implementing nonces in PHP apps. Thanks! zerkms Nonce is usually some random string that is added to request just to

Java Webservice Client UsernameToken equivalent to PHP

由 巧了我就是萌 提交于 2019-11-30 01:01:27
I have a webservice build in PHP that uses UsernameToken as authentification mechanism. I have PHP client side code that can access this web service. Now I need to do this in Java. Maybe you can help me! This service can be accessed using the following php code: $password="super_secure_pass"; $timestamp=gmdate('Y-m-d\TH:i:s\Z'); $nonce=mt_rand(); $passdigest=base64_encode(pack('H*',sha1(pack('H*',$nonce).pack('a*',$timestamp).pack('a*',$password)))); $nonce=base64_encode(pack('H*',$nonce)) These values get parsed into this Soap header. <wsse:Security SOAP-ENV:mustUnderstand="0" xmlns:wsse=

CSRF tokens vs Nonce confusion - are they the same?

由 旧时模样 提交于 2019-11-29 17:47:56
问题 In a attempt to make the current application I'm developing more secure, I've been reading about CSRF tokens and also Nonce. My question simply is, Are CSRF tokens and Nonce the same thing? from what I could gather so far is that both these methods have different techniques to accomplish the same goal, or am I misunderstanding something? If they are different, could you be nice enough to provide some example code or point me to some links where i can learn more about how to implementing

Java Webservice Client UsernameToken equivalent to PHP

由 女生的网名这么多〃 提交于 2019-11-28 22:33:36
问题 I have a webservice build in PHP that uses UsernameToken as authentification mechanism. I have PHP client side code that can access this web service. Now I need to do this in Java. Maybe you can help me! This service can be accessed using the following php code: $password="super_secure_pass"; $timestamp=gmdate('Y-m-d\TH:i:s\Z'); $nonce=mt_rand(); $passdigest=base64_encode(pack('H*',sha1(pack('H*',$nonce).pack('a*',$timestamp).pack('a*',$password)))); $nonce=base64_encode(pack('H*',$nonce))

Should Nonces Be Used During Log-In?

由 橙三吉。 提交于 2019-11-28 11:29:11
问题 Wikipedia presents the following example of nonce-based authentication: Client requests nonce from server. Server responds with nonce (i.e., hereafter referred to as "server nonce"). Client uses server nonce, its own client nonce, and user-inputted password to generate a hash. Client sends user-inputted username, client nonce, and hash to server. Server retrieves both server nonce and user password from its database, presumably via username. Server combines server nonce, client nonce and

What’s the purpose of the HTML “nonce” attribute for script and style elements?

由 六月ゝ 毕业季﹏ 提交于 2019-11-27 10:31:13
W3C says there is a new attribute in HTML5.1 called nonce for style and script that can be used by the Content Security Policy of a website. I googled about it but finally didn't get it what actually this attribute do and what changes when using it? The nonce attribute enables you to “whitelist” certain inline script and style elements, while avoiding use of the CSP unsafe-inline directive (which would allow all inline script / style ), so that you still retain the key CSP feature of disallowing inline script / style in general. So the nonce attribute is way of telling browsers that the inline

What's the point of a timestamp in OAuth if a Nonce can only be used one time?

由 不羁岁月 提交于 2019-11-27 00:27:32
问题 I had at first misinterpreted the timestamp implementation of OAuth into thinking that it meant a timestamp that was not within 30 seconds past the current time would be denied, it turned out this was wrong for a few reasons including the fact that we could not guarantee that each system clock was in sync enough down to the minutes and seconds regardless of time zone. Then I read it again to get more clarity: "Unless otherwise specified by the Service Provider, the timestamp is expressed in

What’s the purpose of the HTML “nonce” attribute for script and style elements?

由 旧巷老猫 提交于 2019-11-26 15:08:05
问题 W3C says there is a new attribute in HTML5.1 called nonce for style and script that can be used by the Content Security Policy of a website. I googled about it but finally didn't get it what actually this attribute do and what changes when using it? 回答1: The nonce attribute enables you to “whitelist” certain inline script and style elements, while avoiding use of the CSP unsafe-inline directive (which would allow all inline script / style ), so that you still retain the key CSP feature of

How to create and use nonces

由 与世无争的帅哥 提交于 2019-11-26 03:25:01
问题 I am running a website, and there is a scoring system that gives you points for the number of times you play a game. It uses hashing to prove the integrity of http request for scoring so users cannot change anything, however as I feared might happen, someone figured out that they didn\'t need to change it, they just needed to get a high score, and duplicate the http request, headers and all. Previously I\'d been prohibited from protecting against this attack because it was considered unlikely
订阅 nonce