Skip to main content

Stack Exchange
security
security
▾ show details

security
▴ show summary


activity newest no answers
0 answers

Is it OK for Electron app to store source code in sqlite database and than later execute using `new Function`

The application I'm working at the moment requires to store some source code on the client's machine, so it could be executed later. So I chose to store it in the sqlite database and than execute it ...

javascript security electron eval 1 hour ago by alexpopocoder on Stack Overflow stackoverflow.com
1 answer

I can't auto login user after registration in spring boot

when i registrate user my project throws stackOverFlowError, but user is saved to database.I also have registration form. Here is my registration controller: @PostMapping("/register-user") ...

java spring security registration autologin 1 answers | 1 hour ago by abdullakh mirfayziev on Stack Overflow stackoverflow.com
1 answer

How to send a HTTP Cookie using the Set-Cookie header over a HTTP connection?

I'm developing the backend for a web application using the Java Spring Framework and Spring Security. I'm trying to create a login system using JWT, by sending the JWT access token from the server to ...

java spring http security 1 answers | 11 hours ago by Jaehyuk Chang on Stack Overflow stackoverflow.com
1 answer

Ways to allow inline script for script-src CSP header without using nonce/hash/unsafe-inline

Is there any way that allows inline script for script-src CSP header without using nonce/hash/unsafe-inline ? Since our project is huge and there are multiple areas where inline script is present We ...

security xss content-security-policy inline-scripting script-src 1 answers | 15 hours ago by Anonymous on Stack Overflow stackoverflow.com
2 answers

Is it safe to use the `Function` constructor to validate JavaScript syntax?

I would like to verify (client-side) that the user has entered valid JavaScript code. Pulling in a Javascript parser (e.g. Acorn or Esprima) is a relatively heavy dependency. However (if CSP is not ...

javascript security eval client-side 2 answers | 16 hours ago by cloudfeet on Stack Overflow stackoverflow.com
1 answer

reCAPTCHA cookie is not being passed for subdomains, only the domain where the reCAPTCHA is being set

Domains are fictional :) I have a website hosted at: app.sunsetland.com.au In that website, on one page I <embed> another website which is hosted at subdomain.sunsetland.com.au Our GCP Cloud ...

security google-cloud-platform cookies recaptcha google-cloud-armor 1 answers | 22 hours ago by Candace Wong on Stack Overflow stackoverflow.com
0 answers

I'm making a program to prevent discord token theft

I'm making a program to prevent discord token theft. And I have a question, how do all these viruses get the discord token from the discord application? What files do they download it from and how do ...

security discord token samplegrabber yesterday by Filip G on Stack Overflow stackoverflow.com
0 answers

Unable to execute Google Classroom API script due to possible threat detection

I work in the ICT department of a university. At the beginning of each semester, I need to create Google Classroom courses and enroll members based on the university's course data. I have been using a ...

security google-apps-script google-classroom yesterday by kztk on Stack Overflow stackoverflow.com
0 answers

Android Emulator detection is not working for some devices

I have a piece of native code with C in my Android project for detecting emulators. It works perfectly for detecting all Emulators but some real devices are detected as vulnerable too. How can I ...

android c security native-code android-14 yesterday by nima on Stack Overflow stackoverflow.com
0 answers

Incorrect redirect to /login causing issues

I keep running into an error on my first React-Spring Boot project that I just cannot work out. I have an Auth Controller that sets a user session on successful login - which it does. I am getting the ...

reactjs spring security endpoint 2 days ago by Laura Ferry on Stack Overflow stackoverflow.com
2 answers

How can I prevent post variables from appearing in the Yii2 log when I call warning() or info()?

I am maintaining an app built in Yii2, and I want to use Yii::warning() to write log messages. This is fine except when I'm logging events in the user login sequence. The username and password are ...

php security yii error-handling yii2 2 answers | 2 days ago by Mnebuerquo on Stack Overflow stackoverflow.com
1 answer

How to generate test alert/incident in "Microsoft 365 Defender" portal for test purpose?

I want to generate test alert in "Microsoft 365 Defender" portal. I have tried to login "portal.azure.com" and "outlook.office.com" from tor browser; and I was expecting ...

security azure-security microsoft365-defender 1 answers | 2 days ago by shalin makhecha on Stack Overflow stackoverflow.com
0 answers

Is it appropriate for an application (SPA) to pass an "extra" access token to a backend service (so that service can call other services)?

I have a web application (SPA), which we'll call A. This application calls an API service (that I control), which we'll call B. Service B uses OAuth authentication, and trusts an issuer I. In my ...

authentication security single-page-application openid Jul 18 at 19:02 by Mark on Stack Overflow stackoverflow.com
1 answer

Best tools for Thick Client Penetration Testing

I am looking for Application Security Testing (Penetration Testing) of Thick Client Applications. I know of Echo Mirage and ITR as good tools to test these kinda applications. Does anyone know of ...

security thickbox 1 answers | Jul 18 at 18:50 by Dharmesh Mehta on Stack Overflow stackoverflow.com
1 answer

jenkins assign roles to views

I have a Jenkins, which is integrated with AD, using Global Security. I know already, that I can assign, with Role Strategy Plugin, role-based access for some AD users\groups to particular projects. ...

security jenkins jenkins-plugins 1 answers | Jul 18 at 15:40 by Vasyl Stepulo on Stack Overflow stackoverflow.com
3 answers

How can I detect an overposting attack in ASP.MVC during model binding?

I want to determine if a user is attempting an overposting attack in Asp.NET MVC. How can I determine if someone is sending special values (via Fiddler for example) to my controller? Note the "...

asp.net-mvc security model-binding 3 answers | Jul 18 at 15:16 by makerofthings7 on Stack Overflow stackoverflow.com
0 answers

How to install CDO on Alpine:3.20 docker image

I am trying to set up a Docker container based on Alpine Linux. The container needs to have Python 3.12.4 installed with Dask and Zarr. I had to install it from the source, and it went well. However, ...

python-3.x docker security alpine-linux cdo-climate Jul 18 at 14:05 by thered86 on Stack Overflow stackoverflow.com
8 answers

How to allow SELECT queries and prevent others?

In our application, users can create custom export functions in form of SQL statements. Something like this: SELECT name, age, date_birth FROM users WHERE group_id = 2 I don't want them to clear the ...

php mysql security 8 answers | Jul 18 at 13:07 by Christoph Bühler on Stack Overflow stackoverflow.com
2 answers

How to calculate BLE SC Pairing Confirm Value for Passkey Entry in Python?

I'm implementing some Bluetooth Low Energy functionalities in Python. In the pairing process there is a Pairing Confirm Value like specified in Bluetooth Core Specs 5.3 page 1604 and 1562f. I have the ...

security bluetooth-lowenergy python-cryptography 2 answers | Jul 18 at 12:48 by Pascal Rockenstiehl on Stack Overflow stackoverflow.com
1 answer

Unable to install jimp library through npm bcz of vulnerabilities checks

phin <3.7.1 Severity: moderate phin may include sensitive headers in subsequent requests after redirect - https://github.com/advisories/GHSA-x565-32qp-m3vf fix available via npm audit fix --...

security npm jimp 1 answers | Jul 18 at 11:15 by Ragavi Krishna on Stack Overflow stackoverflow.com
0 answers

What is the meaning of frame-src 'self' blob:?

I want to restrict my site to blob: only from its own origin. I thought frame-src 'self' blob: would do that but checking on checked on CSP evaluator the results are: It shows 'self' & blob. ...

security blob content-security-policy Jul 18 at 8:03 by Vaishali this side on Stack Overflow stackoverflow.com
2 answers

What does "wsse:InvalidSecurity" mean?

An error was discovered processing the <wsse:Security> header This is a WS-Security question btw... I can't see anything wrong with my WS endpoint (apart from the fact that it's running in a ...

web-services security ws-security pki 2 answers | Jul 17 at 23:58 by Mark Hesketh on Stack Overflow stackoverflow.com
1 answer

What is the alternate to PasswordDigest when clear text password is not stored on the web-service producer?

Scenario: Web-service producer have only SHA-1 hash of passwords stored in database. We need to authenticate Web-service users using User Name/Password combination. Web Services Security ...

web-services security passwords ws-security wss4j 1 answers | Jul 17 at 23:43 by Tahir Akhtar on Stack Overflow stackoverflow.com
2 answers

WCF: Web Service Login / Authentication: HowTo?

We have a web service (WCF in C#) that has been used on an intranet until now. Going forward we want to open it up to the internet. Obviously we are concerned that naughty people cannot access the ...

c# authentication security wcf 2 answers | Jul 17 at 23:40 by Andrew White on Stack Overflow stackoverflow.com
1 answer

Spring Boot OAuth2 is redirecting to IDP on each unauthorized request

I have made an OAuth2 configuration in Spring Boot. It also works, especially when I make get requests via the browser URL and I am not yet authenticated, I am redirected to the IDP, I can log in and ...

spring security oauth-2.0 single-page-application 1 answers | Jul 17 at 21:48 by original_1887 on Stack Overflow stackoverflow.com
1 answer

If I have already a HTTPS can I use wss, or I need to pay additional fee?

I'm wondering if I have to pay additional fee, if I already bought a HTTPS.

security websocket https 1 answers | Jul 17 at 21:36 by Null on Stack Overflow stackoverflow.com
2 answers

Is it possible to force socket.io to use wss instead of ws, without having to change to https?

I have been trying to setup a server where users can send sign in using websockets, but I don't want to do this using ws. I want to be able turn on wss without having https. Sadly, there aren't any ...

javascript security websocket socket.io 2 answers | Jul 17 at 21:32 by Kitanga Nday on Stack Overflow stackoverflow.com
0 answers

websocket secure connection wss://localhost:443/ not making a connection to server

I have a client server application, but when I try to make a WSS connection, it gives me an error. static void Main(string[] args) { Connect("wss://localhost:8080/...

security websocket connection Jul 17 at 20:53 by Rupinder Singh Girn on Stack Overflow stackoverflow.com
0 answers

Is rapid IP switchting available for attackers on TCP servers?

I'm working on a server implementation and I'm wondering how quickly attackers can switch ip addresses. I know with UDP attackers can actually just send in whatever ip address they want, but with TCP ...

security server tcp backend Jul 17 at 17:27 by brando f on Stack Overflow stackoverflow.com
1 answer

Can we test injection attacks in API parameters with Zap?

Can we test injection attacks in API parameters with Zap tool? With Zap I am trying to scan APIs. Provided Bearer token with a script and Swagger API definition file. I am getting results related to ...

security zap 1 answers | Jul 17 at 16:38 by viks on Stack Overflow stackoverflow.com
15 30 50 per page
1 2 3