Questions tagged [client]
In a client-server model, the server serves services to the client.
25 questions
74
votes
4
answers
21k
views
What is PKCE actually protecting?
I'm trying to get my head around how PKCE works in a mobile app and there's something I don't quite understand.
So from what I can gather the client app creates a random cryptographically secure ...
- 877
16
votes
1
answer
22k
views
Client certificate common name? Subject alternative name?
For an IoT project, I want to secure client server communication. I want both the server (Apache) and the clients identify/authenticate each other (a client won't communicate with other clients) ...
- 315
9
votes
3
answers
1k
views
Is it possible to store / record HTTPS client auth traffic as a signed document?
In a scenario where there are client RSA certificates (e.g. on a smart card), is it possible to record a form submission (or an AJAX request) in a form which makes it possible to later ascertain that ...
- 193
3
votes
1
answer
3k
views
How does do client authentication work over https?
I recently wrote an application that calls out to a 3rd party service to perform some work. This 3rd party service requires that I authenticate the client calling by using a client certificate. For ...
- 133
15
votes
2
answers
20k
views
Validating an SSL certificate chain according to RFC 5280: Am I understanding this correctly?
we're in the process of replacing certificates with SHA1 hash due to Google's move to let them appear less secure in Chrome. The replacement certificates use a different intermediate CA than the ones ...
- 153
4
votes
2
answers
3k
views
SSL/TLS client authentication - practical client cert validation
How do real HTTPS servers validate client certificates? My context is business-to-business rather than regular human clients. I understand basic chain validation to a trusted root CA cert. But do ...
- 41
2
votes
2
answers
6k
views
Create client certificates using signed certificate
We have a proper signed server certificate and intermediate CA from a trusted certificate authority.
Is it true that we cannot use this certificate (so the intermediate CA) for creating our own ...
- 913
28
votes
5
answers
38k
views
What are the security issues with "eval()" in JavaScript?
Every time that someone mentions eval(), everyone says that there are "security issues" with it, but nobody ever goes into detail about what they are. Most modern browsers seem to be able to debug ...
- 564
20
votes
2
answers
20k
views
How does a server validate the Certificate Verify message in SSL/TLS?
Client authentication may be used in a SSL/TLS negotiation.
For this, the client will send a CertificateVerify after the server requested it.
The CertificateVerify message contains the client ...
- 737
11
votes
5
answers
10k
views
How To Prove That Client Side Javascript Is Secure?
Imagine that you have a web application that encrypts the user's data, such as a note or spreadsheet, on both the server and client.
The normal process for a user using this web application is ...
- 215
9
votes
3
answers
17k
views
Certificate Chain checking
I have a very specific question.
A client verifies a server by taking the certificate and checking specific values and that the digital signature of the intermediate CA is correct (according to the ...
- 91
6
votes
2
answers
620
views
Secure Software: How to ensure caller is authentic?
For multiplayer (competitive) games, there is often the issue of needing to detect illegitimate players so they can be denied service. On the other hand, legitimate players should of course be ...
- 225
4
votes
3
answers
1k
views
Server client verification
When writing a server sofware, what are the methods used to verificate the user connected to the server is actually using the official client program ?
This is to prevent the access to the server ...
- 163
29
votes
2
answers
9k
views
Why would the BBC web site always ask for a personal certificate, and how do I avoid giving it away?
After installing a CAcert personal certificate, every time I land on the BBC weather site it asks me to identify myself with a certificate.
Why would any non-malicious web site do that unless I've ...
- 3,045
25
votes
6
answers
7k
views
Alternatives to HTML's deprecated <keygen> for client certs?
The keygen tag is used to make browsers generate private keys and POST the resulting CSR to the server, which can then issue a certificate. It's now been deprecated, for rather stupid reasons but that'...
- 12.9k