Items tagged security in 2012
Filters: Year: 2012 × security × Sorted by date
I would like to setup a web-server which will be used solely by myself. What would be the safest way to do so in terms of confidentiality of the contents?
I haven’t configured them myself, but it might be worth looking in to client SSL certificates for this. That way your server won’t communicate with any browser that hasn’t installed a certificate which you generate. I believe the BBC used to use this for a lot of their important servers which they wanted to be accessible only by their own developers from across the internet (I don’t know if they still do).
[... 108 words]What are the best practices to avoid XSS and SQL Injections attacks (platform agnostic)?
Input validation is, in my opinion, a red herring. Sure—if you ask the user for an integer or date you should make sure they entered one before attempting to save it anywhere or use it for processing, but injection attacks often involve text fields (e.g. names, or comments posted on Quora) and validating those on input is a recipe for banning “Tim O’Reilly” from ever creating a proper profile on your site!
[... 316 words]