Questions tagged [server-security]
The server-security tag has no summary.
18 questions
1 vote
1 answer
707 views
Should I store session id in server database?
I wanted to implement login system using flask framework. I managed to do this using sessions and set them to expire after 31 days and it works (sessions are created using server secret key, timestamp ...
- 21
0 votes
1 answer
99 views
How to control, or moderate, files uploaded with a bug report?
Presume a desktop application presents a Problem Reporting interface as part of it's GUI, and I wish to allow users to upload files as part of that PR. One would hope this is only ever used for ...
- 179
1 vote
0 answers
229 views
How to separate user data in database models?
I am writing a web service for research and learning purposes and try to find an approach to separate user data from other users to ensure a request can never deliver or reveal data from another user. ...
- 121
0 votes
1 answer
166 views
How to reduce DoS and DDoS attacks in an authenticated web server
I came up with an model to reduce DoS and DDoS attacks and would like your input on its effectiveness... Basically, once a request reaches our servers without having a valid key, we add a key as a ...
- 107
3 votes
1 answer
428 views
Why are cloud services needed for push notifications?
We currently have a customer that wants us to implement push notifications to our app. The problem is that for this customer, security is really, really important... I am not able to find any official ...
- 39
2 votes
1 answer
141 views
Do i need to implement Security for my webpage, if it is only connected to a LAN
I am making a websocket server that can communicate with clients. This server is going to be on a private vLAN channel on a public place, AKA only the staff have access to the network which the ...
-2 votes
1 answer
95 views
Web Security (PHP) - Is it Secure to do downloading files & presenting with Headers to the End User ?
I have security question that i am not sure if this approach is safe and secure way to download a file and present to a web user ? We have customers invoice files stored in a server location (...
- 1,183
1 vote
1 answer
1k views
Do I need to secure communications between microservices in a cluster?
So, let's say I have a standard set up for application, that is: - split into micro services - and is running in a cluster (kubernetes or docker swarm, I guess specific implementation does not matter, ...
- 1,334
0 votes
1 answer
531 views
Send data between database and Apache Cordova app in a secure way
I'm developing a Cordova app and I've got the UI ready but I need data to my app from a database. For example I want my cordova app to include user authentication when the user opens the app which ...
- 1
1 vote
1 answer
346 views
Is opening a templating engine to users a bad idea?
My site allows users to create custom HTML templates for their profiles (very much like Tumblr and the theme system), and I picked the Twig template engine for the site. However, I'm not sure if it'...
- 209
2 votes
2 answers
640 views
Why are Strings in StringPool considered insecure?
Passwords are recommended to be stored in char[] instead of String, as Strings are stored in StringPool. Read more here As per this question Strings in StringPool are not available directly. To ...
- 167
63 votes
8 answers
11k views
Securing sensitive data from developers
I have an enterprise application running that uses both MySQL and MongoDB datastores. My development team all have SSH access to the machine in order to perform application releases, maintenance, etc. ...
- 764
8 votes
1 answer
308 views
Securely sending data from shared hosted PHP script to local MSSQL
I'm trying to add data from a webhook (from a web cart) to a local Microsoft SQL Server. It seems like the best route for me is to use a PHP script to listen for new data (POST as json), parse it, ...
- 81
1 vote
2 answers
324 views
Are random number generators security holes?
If I retrieve a random number from a database (e.g. RAND() in SQL Server) or using a programming language and send this in some form back to a client machine, is there an economic chance I will be ...
- 295
0 votes
2 answers
237 views
How can I limit access for automatically generated files to specific users in a MVC setup?
I have a typical MVC based website, and I'd like to give some registered users the abillity to extract data from the database (in a variety of formats). The workflow is very simple: User logs in, ...
- 29