Improving Web Application Security: Threats and - CGISecurity

Chapter 4: Design Guidelines for Secure Web Applications 97Design Guidelines SummaryTable 4.2 summarizes the design guidelines discussed in this chapter and organizesthem by application vulnerability category.Table 4.2 Design Guidelines for Your ApplicationCategoryGuidelinesInput ValidationDo not trust input; consider centralized input validation. Do not rely onclient-side validation. Be careful with canonicalization issues. Constrain,reject, and sanitize input. Validate for type, length, format, and range.AuthenticationAuthorizationConfigurationManagementSensitive DataSession ManagementCryptographyParameter ManipulationException ManagementAuditing and LoggingPartition site by anonymous, identified, and authenticated area. Usestrong passwords. Support password expiration periods and accountdisablement. Do not store credentials (use one-way hashes with salt).Encrypt communication channels to protect authentication tokens. PassForms authentication cookies only over HTTPS connections.Use least privileged accounts. Consider authorization granularity. Enforceseparation of privileges. Restrict user access to system-level resources.Use least privileged process and service accounts. Do not storecredentials in plaintext. Use strong authentication and authorization onadministration interfaces. Do not use the LSA. Secure thecommunication channel for remote administration. Avoid storing sensitivedata in the Web space.Avoid storing secrets. Encrypt sensitive data over the wire. Secure thecommunication channel. Provide strong access controls on sensitive datastores. Do not store sensitive data in persistent cookies. Do not passsensitive data using the HTTP-GET protocol.Limit the session lifetime. Secure the channel. Encrypt the contents ofauthentication cookies. Protect session state from unauthorized access.Do not develop your own. Use tried and tested platform features. Keepunencrypted data close to the algorithm. Use the right algorithm and keysize. Avoid key management (use DPAPI). Cycle your keys periodically.Store keys in a restricted location.Encrypt sensitive cookie state. Do not trust fields that the client canmanipulate (query strings, form fields, cookies, or HTTP headers).Validate all values sent from the client.Use structured exception handling. Do not reveal sensitive applicationimplementation details. Do not log private data such as passwords.Consider a centralized exception management framework.Identify malicious behavior. Know what good traffic looks like. Audit andlog activity through all of the application tiers. Secure access to log files.Back up and regularly analyze log files.