Improving Web Application Security: Threats and - CGISecurity

106 Part II:Designing Secure Web ApplicationsHow Do You Validate Input?What approach to input validation does your design specify? First, your designshould lay out the strategy. Your application should constrain, reject, and sanitize allof the input it receives. Constraining input is the best approach because validatingdata for known valid types, patterns, and ranges is much easier than validating databy looking for known bad characters. With a defense in depth strategy, you shouldalso reject known bad input and sanitize input.The following questions can help you identify potential vulnerabilities:● Do you know your entry points?Make sure the design identifies entry points of the application so that you cantrack what happens to individual input fields. Consider Web page input, input tocomponents and Web services, and input from databases.● Do you know your trust boundaries?Input validation is not always necessary if the input is passed from a trustedsource inside your trust boundary, but it should be considered mandatory if theinput is passed from sources that are not trusted.● Do you validate Web page input?Do not consider the end user as a trusted source of data. Make sure you validateregular and hidden form fields, query strings, and cookies.● Do you validate arguments that are passed to your components or Web services?The only case where it might be safe not to do so is where data is received frominside the current trust boundary. However, with a defense in depth strategy,multiple validation layers are recommended.● Do you validate data that is retrieved from a database?You should also validate this form of input, especially if other applications write tothe database. Make no assumptions about how thorough the input validation ofthe other application is.● Do you centralize your approach?For common types of input fields, examine whether or not you are using commonvalidation and filtering libraries to ensure that validation rules are performedconsistently.● Do you rely on client-side validation?Do not. Client-side validation can be used to reduce the number of round trips tothe server, but do not rely on it for security because it is easy to bypass. Validate allinput at the server.