I regularly use a standard form to send login information through the HTTP POST method and then validate it using php to check if the details are correct. I use an md5 hash on the passwords (and sometimes usernames) to give some degree of security, so I'm not storing a raw password in my code in case it's viewed by an unauthorised person...
I'm writing a simple in-house frontend to Subversion. We've got an Apache setup serving up the SVN repositories thanks to WebDAV. Also, authentication is done through an Apache realm and Open Directory. For what it's worth, this is basically a pretty vanilla Mac OS X Server 10.6 setup. Now, some of the tasks our front end is responsible...
Should we guard against unanticipated user input from dropdown lists? Is it plausible to expect a user to somehow modify a dropdown list to contain values that weren't originally included? How can they do this and how can we stop it? ...
Hi a) When current user accesses Profile object for the first time, does Asp.Net retrieve a complete profile for that user or are profile properties retrieved one at the time as they are called? b) In any case, is profile data for current user retrieved from DB each time it is called or is it retrieved just once and then saved for...
Hi 1) Is there a reason why aspnet_Profile table doesn’t have ApplicationId column, while aspnet_Membership and aspnet_Roles tables do define ApplicationID columns? 2) If we create a profile for current user and then change the applicationName of our profile provider, then profile for same user couldn’t be read anymore. So it see...
Lets say that in a browser based game, completing some action (for simplicity lets say someone clicks on a link that increases their score by 100) clicking on this link which would have a url for example increase_score.pl?amount=100 what kind of prevention is there from someone simply sending requests to the web server to execute this co...
There are a lot of questions about salts and best practices, however most of them simply answer very specific questions about them. I have several questions which feed into one another. Assuming a database is compromised a per user salt prevents the use of generic rainbow tables to crack passwords. A separate rainbow table would have ...
A Django app that I am working has an Event model. An Event may have associated photos, static html files and pdf files. I would like to allow trusted users to upload these files, but I am wary about security, especially having read the following in the Django docs (link). Note that whenever you deal with uploaded files, you shoul...
What Oracle roles/privileges do I need to create a trigger on a table in another schema? ...
I need to set up a "throw-away" instance of SQL Server 2008 for students to test a program for a few weeks. SQL Server 2008 is running on a virtual instance of Windows Server 2008. The server is not a member of the domain. The client computers that need to connect to the SQL Server are domain members, as are the student accounts. The cli...
How secure are XPS documents? After looking from the inside of an XPS document, found the Unicode-string property. Could someone inject e.x. a script into the Unicode string property? How the XPS viewer, treats the Unicode string property? As a collection of glyphs or what? UPDATE: I added the following string as UnicodeText !@#$%^&*...
I have this code in a page that includes other files via GET request: $page = strtolower($_GET['page']); if(!$page or !$allow[$page] or $page == 'home') { header("Location: home.php"); } where $allow is a hardcoded array which contains a list of the allowed strings that are valid files to be included. Am I missing something obvi...
I have a desktop application with a remote interface. The access to the remote interface is secured by a username and password. What would be the best way to save these password securely, preferably in the registry? ...
Hi all, I am currently working on a building community website in PHP. This contains forms that a user can fill right from registration to lot of other functionality. I am not an Object-oriented guy, so I am using functions most of the time to handle my application. I know I have to learn OOPS, but currently need to develop this website ...
Hi there, I have a model where everything is associated somehow to a single user (e.g. User->Client->Profile). Now a user should only be allowed to (C)RUD on his data (only a profile's owner should be successful accessing /profile/edit/[hisId]), so on nearly every database operation a condition like "'User.id' => $this->Session->read('A...
The Grails Config.groovy setting grails.views.default.codec specifies the default codec used to encode data within ${...} in Grails views. This config setting can take any of the values none (no filtering required), html (to avoid XSS-attacks) and base64 (has no real-world use-case that I know of). The Grails default is none (no filter...
What is the exact difference between the envelope and the email in smtp? Why does the protocol need the envelope? In snail mail, the letter needs not contain addresses and is not visible to the postman (at least that's what you want to believe), so all the routing is made entirely based on the envelope and that is clear to me. However ...
Hi, I have an HTML form where people can make payments on my sites. Instead of using SSL, I'm wondering whether I could use a JS lib that would encrypt the credit card information and send it to the server in clear text but encrypted, than the server would decrypt it. I found several libs that do that, they basically ask for a key pair ...
This seems to be a simple question, but I cannot find the answer after much searching. I have an application that uses the ASP.NET security system. The membership uses a System.Web.ClientServices.Providers.ClientFormsAuthenticationMembershipProvider type for the provider, and the roles, similarly, uses the System.Web.ClientServices.Pro...
I am not a security expert... so I might be very wrong here. Am I right in that the only advantage to using a stronger algorithm is to slow down password cracking? In which case they must have the password hash and so will have already comprimised my database right? As I do not store any thing of real world value what is the point in ...