Improving Web Application Security: Threats and - CGISecurity

736 Improving Web Application Security: Threats and CountermeasuresClass-Level ChecksCheck DescriptionClass and member visibility is restricted. The most restrictive access modifier is used(private where possible).Non-base classes are sealed.Input from outside the current trust boundary is validated. Input data is constrained andvalidated for type, length, format, and range.Code implements declarative checks where virtual internal methods are used.Access to public classes and methods are restricted with principal permission demands(where appropriate).Fields are private. When necessary, field values are exposed by using read/write or read-onlypublic properties.Read-only properties are used where possible.Types returned from methods that are not designed to be created independently containprivate default constructors.Unsealed public types do not have internal virtual members.Use of event handlers is thoroughly reviewed.Static constructors are private.CryptographyCheck DescriptionCode uses platform-provided cryptography and does not use custom implementations.Random keys are generated by using RNGCryptoServiceProvider (and not the Random class).PasswordDeriveBytes is used for password-based encryption.DPAPI is used to encrypt configuration secrets to avoid the key management issue.The appropriate key sizes are used for the chosen algorithm, or if they are not, the reasonsare identified and understood.Keys are not held in code.Access to persisted keys is restricted.Keys are cycled periodically.Exported private keys are protected.