Collaborate Disseminate
I’m developing a HTTP web server. I’ve used HTTPS as the protocol between client and server but I know that HTTPS can’t prevent parameter tampering.
As we know, we can set parameters in URL, in HTTP header or in HTTP body. So clients could… Continue reading What is a proper way to prevent parameter tampering and to make parameter secure
HTTPS security is based on the chain of trust. The initial trusted party (root authority) signs a certificate for some other party and then it can sign for some other.
Does that mean If I have a valid HTTPS certificate for my website, I ca… Continue reading A Potential threat in HTTPS [duplicate]
Let’s say I have 2 SPAs (single page applications), SPA A and SPA B.
I want to share data between the 2 applications for an end-to-end flow.
How can I safely share data such that it would not be susceptible to a MITM attack. Even if the da… Continue reading How to safely share data between 2 SPAs?
Is there any way to reliably identify the referring site on modern browsers (not considering manual HTTP requests outside of a browser e.g. cURL, etc.)?
Referrer header will not work because the referring site could just set Referrer-Polic… Continue reading How to reliably identify referrer on client browser?
When client (Postman for example) is making the request to server, is the client responsible for including the HTTP security headers in the request?
Or is the server responsible for defining these headers and showing them in response?
I co… Continue reading Is API client responsible for HTTP security headers?
How do I combine multiple HTTP requests into one on burp suite? I am trying to do this in Burp Intruder in a way that each request is detected as a separate request but I send it all in one request and everything will come back in one go.
… Continue reading How to combine multiple HTTP requests into one on burp suite?
If API client (Postman for example) makes a call to an exposed HTTPS API endpoint, is the communication between client and server encrypted?
Continue reading Is an API call to HTTPS endpoint encrypted?
I have a scenario where my Nextjs frontend application is running in the cloud with a domain & SSL and I have a nodejs backend.
When I make an API call to the backend nodejs server, I get a CORS error stating a "https to http comm… Continue reading https to http communication error while frontend call to backend
I would like a comprehensive explanation of the security and privacy risks that come with DNS prefetching. There are already other posts about this topic, but I want current information and feedback on my concerns. Thanks in advance.
The H… Continue reading How does DNS prefetching endanger security/privacy?
I am initiating and doing a basic penetration testing course and have come across one doubt.
For example in this URL:
http://webapp.thm/index.php=?page=1
I get that I am requesting the index.php file in the server and I am specifying that … Continue reading Understanding of HTTP GET request