Archives for Software Dev - Page 2
Thales HSM – Key Concepts
Thales HSM – Key Concepts Applies to Luna, nShield, and Thales Data Protection on Demand (DPoD) 1) What an HSM Does Tamper-resistant hardware for generating, storing, and using cryptographic keys…
Decentralized CAs
Operating a Decentralized Certificate Authority with Tokenized Incentives A decentralized Certificate Authority (CA) eliminates reliance on a single central CA. Instead, certificate issuance and revocation are handled by a…
Cross Site Scripting – Explained
Reflected XSS Explained Reflected Cross-Site Scripting (XSS) is a type of web vulnerability where untrusted input is immediately echoed (or "reflected") by the server in an HTTP response without…
How attackers can bypass CloudFlare
Also read CloudFlare and CORs Whitelisting Introduction To ensure that Origin Server denies all IPs except the CloudFlare IP (this will need to be AT the server level, not cloudlfare).…
Why are Root CAs often offline?
Root Certificate Authority Often a Standalone Server? 1. Ultimate Trust Anchor The Root CA is the trust anchor of the entire PKI hierarchy. If compromised, all subordinate certificates become untrustworthy.…
CSRF protection for APIs?
High Level Overview Cookie-authenticated APIs versus Authorization headers What Is CSRF Protection for API Endpoints? CSRF stands for Cross-Site Request Forgery. It’s a type of web attack where a malicious…
How Can a Hacker Abuse Poor CORS Configuration?
Basic High Level Flow The attacker hijacks your authentication credentials (your cookie) - and uses that to call a sensitive API. If the API is callable from 'all origins', then…
File Transfer versus APIs
API vs File Transfer: Choosing the Right Method for Data Exchange APIs and file transfers are both widely used methods for data exchange between systems. While they serve a similar…
What the heck is CORs? Can CloudFlare help me with CORs security issues?
Why CORS Is Important (And How to Secure It) Why CORS Is Important (And How to Secure It) What is CORS and why is it important? CORS (Cross-Origin Resource Sharing)…
Session-based vs Token-based Authentication
Session-based vs Token-based Authentication - Q and A Q: Aren’t session-based and token-based authentication basically the same? At first glance, they do appear similar: You authenticate with a service. The…