The most prominent components of web applications that intruders will first seek to exploit are vulnerabilities within the web platform. The web platform commonly includes:
- Web server software (such as IIS or Apache).
- Extensions to the web server, such as ISAPI filters and extensions, or Apache modules.
- Dynamic execution environments like ASP.NET, PHP, and J2EE (also referred to as application servers).
- Services and daemons, such as user forums or web guestbook packages.
Authentication flaws
- Set a strong password policy which includes Capital letter, Small letter, numbers and some special characters.
- Implement password salting.
- Implement password masking (****).
- Display generic and standard messages in case of authentication failure.
- Validate password policy at both the client side and server side.
- Encrypt the password in storage using a strong algorithm.
- Implement a secure password recovery mechanism.
- Use multifactor authentication for sensitive areas.
- Verify the old password while changing to a new password.
- Make use of OAuth, Centrify, OpenID, and Kerberos or similar tools for implementing single sign-on (SSO).
Authorization flaws
- Implement the principle of least privilege.
- Implement role-based access control.
- Use JSON web tokens (JWT) for secure authentication and information exchange.
- Implement validation checks to prevent authorization creep, and vertical and horizontal privilege escalation.
Session management flaws
- Set an idle session timeout value to limit the duration.
- Set a complex session ID.
- Invalidate the session upon termination of the browser window.
- Regenerate new session ID upon successful authentication or privilege change.
- Implement protection for cross-site request forgery (CSRF).
Input validation flaws
- Client-side data validation.
- Server-side data validation.
- Blacklisting or whitelisting of input characters.
- Data sanitization.
- Content type checks for file uploads.
- Implement virus scanner for file uploads.
- Output validation and encoding.
- Use prepared statements, parameterized queries, and bind variables in the database.
Auditing and logging flaws
- Capture login/logout, failed login, new user creation, and data modification events. Password changes and detailed activity events should also be captured along with user name, timestamp, and the end user’s source IP address.
- Ensure that logging cannot be used to deplete system resources, for example by filling up disk space or exceeding the database transaction log space, leading to denial of service.
- Ensure that logs are protected from tampering .
- Top 7 Commercial Linux Distributions
- Why Do I Need a Website?
- Reinforcement Learning in Real-world Applications: The Latest Successes and Challenges
- Various Python Libraries for developing RESTful APIs
- Top 7 NodeJS Frameworks You Need To Know
- How Buying Instagram Followers Can Help Businesses Soar
- How To Find Gaps In Your Cybersecurity And How To Address Them
- How to close the site from indexing using robots.txt
- Internet Security With VPN – Why Do You Need It
- How to Fix The DLL Missing Error in Windows 7?
