Collaborate Disseminate
This question came across my mind when I sent an ajax request from html to a backend django server and forgot to add a csrf token to the request payload and recieved this error.
403 error means that the request was unauthorized.
I know th… Continue reading What happens first in a request having both CSRF Token and JWT token, authentication or authorization?
I’m trying to figure out the time needed to crack an HTTP digest auth. According to the RFC2069, the digest in calculated according to this scheme :
HA1 = MD5(username:realm:password)
HA2 = MD5(method:digestURI)
response = MD5(HA1:nonce:HA… Continue reading How secure is HTTP auth digest in 2023
I have to secure HTTP requests`s body on application layer, so I wanted to generate signatures with hash of body and the receiver will validate it.
But I can do it in different way and apply it into existing architecture. My server already… Continue reading Applying application-level signing in HTTP
I’m developing an embedded server with limited CPU and RAM to handle HTTPS sessions, and I’m confused by how Chrome and Firefox are handling each TLS session. I am using Mbed TLS and I have tried a variety of cipher suites, including TLS_E… Continue reading TLS v1.2 handshake Chrome vs. Firefox differences
I’m doing a vulnerability assessment for a whole slew of web servers, and almost every single one of them (hundreds) are misconfigured like the following two examples:
Case 1: one or more hostnames resolve to the server’s IP address (let’s… Continue reading CWE for "Misconfigured server allows insecure https request to IP-addressed URL"?
Let’s say ports 80 and 443 open for my website hosted by Amazon AWS. Could someone figure out a way to exploit somehow or is that just nearly impossible and something no one would need to worry about?
Continue reading Could someone hack into my website through http ports?
I received an SMS from an unknown number with a link. Having just ordered stuff from AliExpress bit earlier so, thinking it was related to that, I clicked without doing due diligence. My bad.
I went home and tried using a command line tool… Continue reading I clicked on a SMS spam link. Am I safe? [duplicate]
I have a stateless backend and a spa-frontend. Except for the login request, all requests are secured by a jwt in the header.
Additionally the application should now be secured against csrf. Since the backend is stateless, we want to imple… Continue reading When using double submit cookies as protection against csrf, does it matter where the random key is created?
It is common to say that CORS headers protect against CSRF, so that if you visit a malicious website, it cannot make a request to your web application because the referer header (the URL of the malicious website) wouldn’t be allowed by the… Continue reading Are CORS headers useless?
For instance, suppose we have a request that uses the field name in a request’s body or query params, but the client sends the params name and age. Some web server frameworks allow us to strip properties outside a whitelist so this age par… Continue reading What vulnerability query params or body outside a whitelist can allow?