Collaborate Disseminate
I’d like to encrypt some data on the server using a user-managed secret. I could just ask for a password and derive a key from that, but ideally I’d like to offer users the option of using a yubikey to safeguard the data. This way it would… Continue reading Protect server-side key with client token
The Spring docs state:
Our recommendation is to use CSRF protection for any request that could be processed by a browser by normal users. If you are only creating a service that is used by non-browser clients, you will likely want to disa… Continue reading Why is CSRF protection only applicable to web services with browser clients? [duplicate]
Please note: although I mention Spring Boot (and by proxy, Java) I believe this is a pure HTTP/web development question at heart, and as such, can be answered by anyone with CORS-configuration experience and zero Java experience!
I am con… Continue reading CORS configuration for service with single browser client
Should be the header Expect-CT be set by a server that exposes a SOAP web service over SSL?
Continue reading Should a server set Expect-CT for a SOAP web service?
I have a website built with WordPress, unfortunately somebody hacked it several times, deleted my adsense code and put his own adsense.
I tried many security techniques, changed database name, did some stuff to prevent anybody from editing… Continue reading How to replace certain backup files on a website every 30 minutes?
I’m running a docker container in Kubernetes cluster running in aws, I exposed the container through LoadBalancer service and limited access to it just to my ip address using aws security groups, but I still getting GET/POST requests that … Continue reading Hacking attemps from unkown source
Are there any ways to serve a webpage locally without revealing IP to end users?
When working with cloud services and deployments, the load balancers often use a health endpoint to ensure that the service node is up and running and can take traffic.
To catch as many issues we can before serving the users, we stage our … Continue reading If our service health API shows the commit/service version, what are the risks?
I have been working on a front end (React) app that sends REST requests to an API end point. I am aware that sensitive items such as API keys should not be stored in front end frameworks (like React, for example),
BUT…
Right now, I am j… Continue reading API key safety in front end app running in localhost
have you ever seen such an identifier followed by an application referencing objects?
/show?fuzzzltCfq8Geym-d0tKrto6Jzo-Md5Z8dIie0IWYqJOXi5-cn7DCk9OeqJ9mjJGM0sSozJKYxJRxXg==
Every request have random numbers and letters after ‘fuzzzz’.
… Continue reading Strange identifier in web application [closed]