Arşiv

Günlük Okunma : 24 | 23.06.2008

One of the cardinal rules of the web application security is "Do not trust the user input" but it's loosely defined. We should've said "Do not trust any input!" Which input is coming from the user? Web applications are more complicated than they were. Now we have got office applications and shiny Web 2.0 stuff all over the web. Complexity comes with a price tag and lots of hidden layers. A perfect example of a hidden layer is the second order injections where the injection goes into a back-end storage, then directly pulled out from there and used in an SQL Query, pri......

Günlük Okunma : 17 | 14.05.2008

SSL Implementation Security FAQ is about implementing SSL in web and desktop applications. This FAQ doesn’t cover issues directly related with SSL/TLS. Only covers issues related with implementing SSL in applications. Most of these are common mistakes during the implementation of SSL in the applications. These recommendations are especially critical for e-banking, e-commerce and similar websites. Is it secure switch back to HTTP after login over HTTPS?. Can I put my Login form to HTTP and target my form to HTTPS? What’s the best way to secure an SSL website? How cooki......

Günlük Okunma : 5 | 19.10.2007

Özellikle kaynak kod analizleri yaparken sık sık rastladığım hatalardan biri bu. Güvenlik veya herhangi bir nedenden dolayı uygulamada IP adreslerini loglamak istiyorsunuz ancak potansiyel proxy adreslerini de loglayabilmek için HTTP_X_FORWARDED_FOR HTTP Header' ını da (veya benzer başka HTTP headerları) kullanıyorsunuz. Bu güzel bir fikir çünkü bazı proxyler ziyaretçinin gerçek IP adresini bu HTTP Header(ları) içerisinde gönderiyorlar ama bu işlem yapılırken uygulanan çok yanlış bir model var. Sık şekilde şu kod ile karşılışıyoru......