Improving Web Application Security: Threats and - CGISecurity

Checklist: Security Review for Managed Code 737SecretsCheck DescriptionSecrets are not hard coded.Plain text secrets are not stored in configuration files.Plain text secrets are not stored in memory for extended periods of time.Exception ManagementCheck DescriptionCode uses exception handling. You catch only the exceptions that you know about.Exception details are logged on the server to assist in diagnosing problems.The information that is returned to the end user is limited and safe.Code that uses exception filters is not sensitive to filter execution sequence (filter runsbefore finally block).Code fails early to avoid unnecessary processing that consumes resources.Exception conditions do not allow a user to bypass security checks to run privileged code.DelegatesCheck DescriptionDelegates are not accepted from untrusted sources.If code does accept a delegate from untrusted code, it constrains the delegate before callingit by using security permissions with SecurityAction.PermitOnly.Permissions are not asserted before calling a delegate.SerializationCheck DescriptionSerialization is restricted to privileged code.Sensitive data is not serialized.Field data from serialized data streams is validated.ISerializable.GetObjectData implementation is protected with an identity permission demandin scenarios where you want to restrict which code can serialize the object.