security

How to secure my AngularJS and Web Api application

由 耗尽温柔 提交于 2019-12-31 08:59:12
问题 I am using AngularJS with ASP.NET Web Api server side. Seems to me like authentication has now become a breeze? Or is this too good to be true? So I'm thinking of using the Web Api's "Individual User Accounts" authentication. And I am thinking that is all I need. As long as every request is authenticated and noone can get any data they shouldn't I shouldn't need to do much more right? Or am I missing some key security fundamentals? 回答1: When it comes to securing the API you have two main

AES256 CBC + HMAC SHA256 ensuring confidentiality *and* authentication?

由 限于喜欢 提交于 2019-12-31 08:49:11
问题 I'm thinking of using AES256 CBC + HMAC SHA-256 as a building block for messages that ensures both confidentiality and authentication. In particular, consider this scenario: Alice is possession a public key belonging to Bob (the key exchange and algorithm is outside the scope of this question). Alice has an identifying key K, also shared with Bob, that she can use to identify herself with. Only Alice and Bob knows the key K. Alice encrypts (nonce || K) using Bob's public key. Bob decrypts the

WebSockets authentication

由 谁都会走 提交于 2019-12-31 08:45:09
问题 What are the possible ways to authenticate user when websocket connection is used? Example scenario: Web based multi-user chat application through encrypted websocket connection. How can I ensure (or guarantee) that each connection in this application belongs to certain authenticated user and "can't be" exploited by false user impersonation during the connection. 回答1: SSL/TLS can be used to authenticate both client and server using X.509 certificates. It depends on the web application

How to Check Authenticity of an AJAX Request

由 独自空忆成欢 提交于 2019-12-31 08:34:11
问题 I am designing a web site in which users solve puzzles as quickly as they can. JavaScript is used to time each puzzle, and the number of milliseconds is sent to the server via AJAX when the puzzle is completed. How can I ensure that the time received by the server was not forged by the user? I don't think a session-based authenticity token (the kind used for forms in Rails) is sufficient because I need to authenticate the source of a value, not just the legitimacy of the request. Is there a

Why CSRF token should be in meta tag and in cookie?

由 纵然是瞬间 提交于 2019-12-31 08:29:29
问题 What's the need of to put CSRF token name and value inside <head> tag using <meta> like: e.g: <meta content="authenticity_token" name="csrf-param" /> <meta content="4sWPhTlJAmt1IcyNq1FCyivsAVhHqjiDCKRXOgOQock=" name="csrf-token" /> I've read about concept to keep CSRF value in cookie but does not find about why to keep inside <head> tag. 回答1: To prevent CSRF you need a value that is submitted with the request that cannot be sent by a malicious site. Authentication cookies are not suitable

Shellcode for a simple stack overflow: Exploited program with shell terminates directly after execve(“/bin/sh”)

由 泪湿孤枕 提交于 2019-12-31 08:25:44
问题 I played around with buffer overflows on Linux (amd64) and tried exploiting a simple program, but it failed. I disabled the security features (address space layout randomization with sysctl -w kernel.randomize_va_space=0 and nx bit in the bios). It jumps to the stack and executes the shellcode, but it doesn't start a shell. The execve syscall succeeds but afterwards it just terminates. Any idea what's wrong? Running the shellcode standalone works just fine. Bonus question: Why do I need to

How do I make a completely ACCESS DENIED Process on Windows?

由 萝らか妹 提交于 2019-12-31 07:59:05
问题 I'm making a security software that is a parental control monitoring system and I don't want any user / administrator or a program to kill my process. I have tried using SetSecurityInfo() but that didn't work. Then SetKernelObjectSecurity but that also didn't do what I wanted. How would I do this? I would also love to have a clear explanation of any code provided. EDIT: If so, how do antivirus programs do it ??? Can you please help me. Im new to WINAPI I would like to know about something

PHP How to create a secure login system with cookies? [closed]

由 南笙酒味 提交于 2019-12-31 07:54:43
问题 Closed. This question is off-topic. It is not currently accepting answers. Want to improve this question? Update the question so it's on-topic for Stack Overflow. Closed 4 years ago . I am trying to create a secure login system using cookies. I have read a lot of articles and Stack Overflow questions on how to achieve that, but couldn't find anything usefull. Everyone is suggests different ways of achieving that, but those who seem reasonable and know what they are doing, I cant quite

How to design SAM deployer policy? to enforce SAM generated AWS resources to be in PermissionBoundary

由 吃可爱长大的小学妹 提交于 2019-12-31 06:59:26
问题 we have someAWSAccount assuming someaccountrole with instance profile name p in AWS. Managed policy by name some-permission-boundary is created in this account( someAWSAccount ). Purpose of creating this boundary policy in this account is mentioned below. Requirement is, Resources: HelloWorldFunction: Type: AWS::Serverless::Function Properties: CodeUri: hello-world/ Handler: app.LambdaHandler Runtime: nodejs8.10 Events: MySQSEvent: Type: SQS Properties: Queue: !GetAtt SomeQueue.Arn BatchSize:

Ie 8.0 Access Denied When Trying To Open Local Files

由 浪子不回头ぞ 提交于 2019-12-31 06:54:25
问题 This script works in IE 6 but not in IE 8.0 My users now get an "Access Denied error". What settings do I refer my users to do enable local file access so that this script will work? <script language="JavaScript"> function viewFile(selectedItem) { for (i=0; i<selectedItem.options.length; i++) { if ((selectedItem.options[i] != null) && (selectedItem.options[i].selected == true)) { window.open("file://"+selectedItem.options[i].text); } } } </script> Users can select multiple files from local
订阅 security