Collaborate Disseminate
In the OWASP Testing Guide, it has a whole section called “Client-Side Testing.” This section has to do with testing for things such as DOM-based XSS, JavaScript execution, HTML injection, Client-Side URL Redirect, etc. The examples in the… Continue reading OWASP Client-Side Testing – How To
As part of an internal Client/Server application, I have created my own (self-signed) Certificate Authority (CA), as well as both Client and Server certificates signed by my CA.
Loading my CA certificates into FireFox in PEM format is rel… Continue reading What are the sources of “SEC_ERROR_REUSED_ISSUER_AND_SERIAL” errors when using self-signed x509 Certificates in PKCS#12 files?
I am currently implementing an iOS app, which integrates with a cloud hosted .net backend system in azure, which.
The api login endpoint takes user/pass -> replies with an signed only HS256 jwt token. All further calls to the endpoint req… Continue reading jwt symmetric signature security risks (from client side)
I’m working on an Interactive Fiction story in Undum, which is a fully client-side JS/HTML5 framework. I’ve been reading about Content Security Policy lately (after looking up what a crypto nonce is) and began to wonder if a… Continue reading What security concerns are there for a fully client-side JS/HTML5 app?
Before you immediately comment “you can’t trust the client!”, please read the whole question.
I’ve been reading about how to prevent XSS attacks lately, and everything I’ve found says that the server should sanitize the data… Continue reading Preventing XSS by filtering data from the server to the client
Certificate authentication on https has always been one of my huge knowledge gaps ,and was trying to fill it today.
I have made some progress on the client side certificate authentication but however there’s some fundamental… Continue reading In client side certificate authentication why, if, do we need to share the certificate
I need help to authenticate users with user credentials.
We are using Angular 5 as a front-end & need to store the user’s email and password if the user checks on Remember Me. Then autofill user credentials after logout and refreshing … Continue reading How to store user credentials in browser securely?
I have a client application installed on my Windows computer and I want to perform a MITM on this application to inspect the traffic.
I understand that Burp can do the MITM for web application, but can it do the same for a cl… Continue reading Can Burp be setup to intercept traffic from client application?
I have a mobile application that needs to be able to work when the phone is offline. In order to prevent misuse by others when they have a short physical access to the phone the requirement is to authenticate the user every t… Continue reading Is there any security concern if I kept password hash on client side?
A topic has come up with some colleagues that appears to be a ‘regular’ and I thought to ask the forum:
We have had use-cases for remote workers who VPN to the corporate network, which does not support split-tunneling, who w… Continue reading A strategy to allow select split-tunneling for printing