Über…
Das ist das Blog von Sven Hasselbach über Themen aus der Entwicklung und alles, was ihm sonst so durch den Kopf geht.
Seit 2003 als freiberuflicher Entwickler deutschlandweit im Einsatz, mit dem Schwerpunkten Lotus Notes & XPages, Spring, Java & OSGi
IBM ICS Champion 2013
Um Kontakt mit mir aufzunehmen, einfach eine eMail an contact<at>hasselba.ch schicken oder mich bei XING finden:
Projektanfragen sind immer willkommen!
Archiv der Kategorie: Security
REST & Security: A Stateless Token Servlet
I have uploaded some of my projects to GitHub, including an alpha version of a stateless token servlet. The servlet has it’s own authentication mechanism (the password is currently not validated), and for developing purposes it uses HTTP GET. In … Weiterlesen
REST & Security: Same-Origin Policy / CORS
The „Same-orginin policy„ is an important concept for protecting web applications. In short, only resources from the same domain are allowed, everything else is permitted denied. To allow access other domains in your application, you have to enable „CORS„, a … Weiterlesen
Veröffentlicht unter Java Script, REST, Security, Web
Verschlagwortet mit REST, Security, ServerSide JavaScript, Web
2 Kommentare
Raspberry Pi vs. IBM Bluemix – 1:0
I had some time last night (the whole family had gone to bed early), so I spent some to look at the XPages integration into Bluemix. I found the Greenwell Travel Expenses Demo: But after clicking a link, the page … Weiterlesen
Security: Usefull HTTP Response Headers
Here is a list of usefull HTTP headers for responses you should know about: X-Content-Type-Options When set to „nosniff„, this header will prevent browsers from MIME-sniffing a response away from the declared content-type. While this header is more relevant for … Weiterlesen
Hardening SSH vs. Eclipse RSE
After hardening the SSH configuration on a Debian server by removing unsecure ciphers and MACs I got in trouble with Eclipse Remote System Explorer. When trying to open the server, I always got an „Algorithm negotiation fail“ message: Even installing … Weiterlesen
Veröffentlicht unter Security
2 Kommentare
REST & Security: CSRF Attacks
In this post I will demonstrate how a do a CSRF attack against a XPages REST service. Let’s assume that we have a custom REST service on a XPage. To keep the example as simple as possible, this service returns … Weiterlesen
REST & Security
I am currently wearing my white hat and doing some pen and vulnerabilty tests for a RESTful API. While this is actually a hot topic in the Domino world, here are some resources: CSRF & REST: Stateless CSRF Protection Stateless Session … Weiterlesen
Security: Another XSS Vulnerability in Domino
Stephan Wissel wrote about a XSS vulnerabilty for Domino servers (< 8.5.4) and in his post you will get an advise how to protect your domino server against this attack. Thanks for this! Works great! But there is still a … Weiterlesen
Veröffentlicht unter Infrastruktur, Java Script, Security, Server, Web, XPages
Verschlagwortet mit 8.5.2, 8.5.3, Bug, Domino, Security, Server, Web, XPages
Schreib einen Kommentar
DocumentDataSource with Signer/SignerWithFullAccess-Rights
Yesterday I read the very interessting question from Daniele Grillo at stackoverflow.com: Is a datasource available for XPages who can access the underlying document with different access levels? I have never seen one before, so I decided to do some … Weiterlesen
Veröffentlicht unter Java, JSF, Security, ServerSide JavaScript, XPages
Verschlagwortet mit 8.5.3, Domino, Java, JSF, Security, ServerSide JavaScript, XPages
7 Kommentare
Security: Domino Server Backdoor (2)
Aus einer XPages-Applikation lässt sich der XSP Command Manager (das zugrundeliegende OSGi Framework) fernsteuern. Das Kommando entspricht dem Befehl tell http xsp <BEFEHL> auf der Domino Serverkonsole, nur dass hierfür kein Serverkonsolenzugriff benötigt wird. Mit Hilfe der folgenden XPage lassen … Weiterlesen