Wise Website Security Practices
Over the years developing web-based applications I have learned a fair amount about following good security practices in your code. So I thought I would share some of those practices here:
- Check Parameters - Always check GET and POST parameters that your application accepts for legal values. These parameters are a critical avenue that attackers typically exploit by jamming values into them that you don’t expect. So, for example, if you’re accepting a two-character state code as a parameter you should check the value you get during a submit against a list of known state codes.
- Strip Suspicious Text - If your website accepts any kind of text string you can be sure that some malicious user will attempt to embed JavaScript into it to try and exploit browser vulnerabilities that other users of your site may not be protected against. Attacks of this variety are commonly known as XSS (Cross Site Scripting) attacks. You will want to search for strings like “<script”, “<embed”, “<object”, and the like and take appropriate action like stripping the strings out or escaping them.
- Require Good Passwords - If your website allows user to create login accounts then you will almost always need to enforce the use of strong passwords that have a mix of alphanumeric and special characters. Don’t allow the password to contain the account name.
- Safely Store Passwords - Passwords should never be stored in clear text. The best way to store them is to not store them at all. Instead, store a cryptographic hash of the password. As an extra level of protection, encrypt the table that stores your user account information.
- Frustrate Password Cracking - Automated tools exist that allow hackers to crack passwords by trying to login to a website repeatedly. If you lock your user account after (let’s say) 5 failed attempts you can prevent this type of attack. Another approach is to introduce an increasing delay between each login validation (e.g., 1 seconds, 2 seconds, 4 seconds, etc.).
- Beware of Temporary Storage - It’s easy to forget about temporary files that your website may create on the server. But if some of these contain passwords or credit card information they could present a possible avenue for attack. Try to avoid passing around critical information in files if at all possible (use shared memory instead).
- Provide an HTTPS Mode - I’m seeing more sites that are providing an option that allows the user to specify that HTTPS should always be used. Twitter has an “Always Use HTTPS” checkbox. The performance penalty with HTTPS isn’t as substantial as in the past so it’s not something we, as website providers, need to be as concerned about anymore.
More security posts to come in the future…
