Questions tagged [secure-coding]
The secure-coding tag has no summary.
152 questions
12
votes
2
answers
4k
views
Why "Only send non-temporary passwords over an encrypted connection or as encrypted data"?
OWASP's Secure Coding Practices Checklist mentions
Only send non-temporary passwords over an encrypted connection or as encrypted data
I can understand why permanent passwords are sent encrypted, ...
- 123
0
votes
0
answers
64
views
standard to identify security checklist for web application/apis
I am looking for a standard to refer to in order to write a security checklist that could be followed to proactively implement security at design level.
I went through the OWASP ASVS, it mentions some ...
- 559
1
vote
1
answer
104
views
What does TG E2EE encrypted chat provide? Given its open source clients
Telegram server is not open source.
Telegram clients are open source.
Users can choose to use E2EE encrypted chat within themselves.
User A know User B in real life and they know each other's telegram ...
- 173
8
votes
4
answers
5k
views
Should order numbers be guessable?
We wrote a e-commerce system where we were asked to generate orders based on a format provided to us
The format was extremely simple which was today's date with total number of orders in the database +...
- 183
0
votes
1
answer
201
views
What are the security related challenges in implementing something like Unix sudo?
There exist several sudo alternatives (systemd's run0, OpenBSD and doas, etc.), all created after sudo has been an established tool, allegedly for security reasons.
If someone were to implement Unix ...
- 103
0
votes
1
answer
114
views
Suggestions for implementing a simplified subset of WebAuthn Relaying Party Operation
Previously some good fellow explained the importance of verifying the public key created and offered by authenticators.
As before, given the complexity of a FULL implementation of RP operation, I ...
- 402
2
votes
0
answers
177
views
Security in Angular: Addressing XSS Concerns with External Libraries and Interpolation
Introduction:
We heavily use external libraries, such as DataTables, in combination with interpolation. In Angular, we've identified two primary XSS prevention strategies:
Interpolation ({{ }})
...
- 31
0
votes
1
answer
1k
views
Secure by Design vs Secure by Default
As an application developer, which of these two principles is considered more secure?
I'm familiar with these concepts at a foundational level. Secure by default means it's secure out the box. ...
- 121
-1
votes
1
answer
133
views
Recommended way to merge a security feature with the rest of the software? [closed]
I am searching for the best way to merge two parts of software together, so it would be as hard as possible to separate them again through reverse engineering.
At the moment are both parts python, but ...
- 56
0
votes
1
answer
241
views
Busines logic bypass issue
Good day, we deployed our app that has payment on it with a wallet system. We tried as much as possible to follow every security rule from server to code design. But yesterday we experienced a bridge ...
- 3
2
votes
0
answers
2k
views
Why do I have to store a refresh token in db
As far as I know, JWT tokens are used for implementing 'stateless server'. But as I try to apply Jwt to my website that uses sessions and cookies for authentication, I found that most people store ...
- 21
1
vote
0
answers
179
views
Lesser known security pitfalls in Python [closed]
I recently came across this article: https://blog.sonarsource.com/10-unknown-security-pitfalls-for-python, which describes security pitfalls in the python programming language that are less well known ...
- 61
8
votes
6
answers
3k
views
Does having no 'if' blocks in code mitigate side-channel attacks?
Looking through descriptions of Spectre and Meltdown it seems that speculative execution - the basis for these attacks - occurs only with branched code. Therefore, it seems logical to conclude that ...
- 498
1
vote
1
answer
193
views
How to secure a code preview function?
Suppose there is an application which contained preview functionality, that means whatever the code (if it is PHP, HTML Python) the user writes, the user can preview the code.
For ex:
<?php echo &...
- 195
0
votes
3
answers
484
views
Security issues of exposing CRUD operations through a single API endpoint?
Imagine an API where all CRUD operations are done through the same POST HTTP Request but with different "action" values from request body.
{
"action":"[create|read|update|...
