Collaborate Disseminate
I am looking for a standard to refer to in order to write a security checklist that could be followed to proactively implement security at design level.
I went through the OWASP ASVS, it mentions some recommendations, but they are generic…. Continue reading standard to identify security checklist for web application/apis
I am using Django REST framework.
I want a single API for all of my clients (web, mobile, curl).
I understand that I need to include a CSRF token in requests originating from the web client, to protect against CSRF. However, this is not ne… Continue reading How to protect web app against login CSRF while also allowing mobile app/curl to access REST API?
I’ve been using the Microsoft ASP.NET Identity Library. It’s a basic authentication and authorization system that is a DLL that stores everything in my app’s DB. It has screens for forgotten password, verify email, etc. It supports roles &… Continue reading Microsoft Identity vs ASP.NET Core Identity
I’ve been using the Microsoft ASP.NET Identity Library. It’s a basic authentication and authorization system that is a DLL that stores everything in my app’s DB. It has screens for forgotten password, verify email, etc. It supports roles &… Continue reading Microsoft Identity vs ASP.NET Core Identity
I am working on a data processing task in an enterprise environment with Python3 installed on a client-side Windows Jump server.
I need to download data regularly from a third-party provider, and it is accessed via a REST API.
The business… Continue reading Log REST API calls in the most auditable way
I read that book websockets are slower than api request if rate of request is Slow. This got me thinking about difference in their overhead, I couldn’t find the actual overhead for websocket, so I am asking question.
In my new team, we use the API of our internal clients, whose request calls and responses contain names of our accounts with the client – for example: dingobiscuits.vodafone.com/data/fetch-something
And some error messages read detailed co… Continue reading API – exposing implementation names, and other details
I have a problem deciding what is the most secure method to send a login request with a username and password strings, I understood that PATCH is less secure than PUT while both are less secure than POST, would it be more sensible then to … Continue reading PATCH request on a login attempt
I am trying to write an automated test that runs on all exposed APIs on a server and checks each endpoint for vulnerabilities.
The problem is the server I am testing always has new APIs exposed, so I want my test to automatically detect ne… Continue reading Can Burp detect new REST APIs exposed on a server
It’s sometimes convenient to generate ids client-side in a typical CRUD app.
The main benefit is for optimistic updates: you can update your client state with the right id without waiting for the response.
Examples:
The id is used in some… Continue reading What security issues could occur when generating ids on the client?