Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Web Developer Security Checklist

simplesecurity.sensedeep.com

Post reply on HN
Print view View original

61–70 of 249 posts

Re: Web Developer Security Checklist

#61

Post by slackingoff2017 »

Besides the bad SQL tips most of it is okay. Sounds like the author has little experience with ORM's or SQL abstraction layers with parameterization like ADO.NET, SQLAlchemy, or JDBC.

Besides the SQL stuff mentioned elsewhere, Regex is rarely a safe whitelist. It's better to use specific escapes for HTML or URI or whatever. Most of XSS is finding bad input that isn't filtered. Hardly anyone is stupid enough to not filter input at all, but few filter it enough to prevent all XSS.

Also keeping port 22 closed is just silly. If you have secure credentials no amount of portscanning will hurt you. If you get tired of the logs just move the port and setup fail2ban. This point is controversial so whatever I guess.

Re: Web Developer Security Checklist

#62

Post by chvid »

Lots of random mostly unnecessary advice that will surely take a simple project and turn it into a big half-baked unmaintainable mess.

Sorry for the harsh words; but good advice needs to be both practical and cost-efficient.

Re: Web Developer Security Checklist

#64

Post by aeronautic »

slackingoff2017 wrote: post #61

Besides the bad SQL tips most of it is okay. Sounds like the author has little experience with ORM's or SQL abstraction layers with parameterization like ADO.NET, SQLAlchemy, or JDBC. Besides the SQL stuff mentioned elsewhere, Regex is rarely a safe whitelist. It's better to use specific escapes for HTML or URI or whatever. Most of XSS is finding bad input that isn't filtered. Hardly anyone is stupid enough to not fi…

Thanks for the tips. Can you say which SQL tip is bad, someone has already picked up the Stored procedure comment -- really meant prepared statements.

Regarding regexp. You can do very precise regexp for many patterns. I agree some are harder, but I wouldn't say "rarely" in our experience.

The point about port 22 is that if you have it open, many people tend to use it more than they should. Effective automation should eliminate / greatly reduce the need for it.

If using AWS/cloud, then you can apply a security group to open when you need, but otherwise keep it closed at the network level at least. I agree it does seem to get people all hot an bothered.

Re: Web Developer Security Checklist

#65

Post by aeronautic »

chvid wrote: post #62

Lots of random mostly unnecessary advice that will surely take a simple project and turn it into a big half-baked unmaintainable mess. Sorry for the harsh words; but good advice needs to be both practical and cost-efficient.

Could you highlight what you think are the important items in a web security checklist?

Re: Web Developer Security Checklist

#66

Post by slackingoff2017 »

badminton1 wrote: post #33

A largely incomplete list. One of the most important items would be: handle errors correctly and make sure errors do not result into any sort of resource leak or sensitive information disclosure. For example, this code was from a guy in Stack Overflow: ... function (req, res, next) { if (err) return console.log(err) What will that piece of code do? Leak the request object, the response object, including the underlyin…

Well, I've avoided the node hype because of people warning about bad debugging experience. With that, I'm going to try to avoid touching it ever.

I've used many web stacks over the years and not a single one defaults to blowing up like that. They all follow proper modularization... The framework cleans up objects that the framework creates, you deal with yours.

In any other framework forgetting to end the request would result in the request automatically ending when your code finishes. This includes Vert.x and Undertow which are just as asynchronous as Node(but also multithreaded).

Also how the hell does that leak memory? Is JS reference counting that bad? I've done some really stupid things in Java and C# but never leaked memory enough that it mattered.

Re: Web Developer Security Checklist

#67

Post by corobo »

aeronautic wrote: post #49
Animats wrote: post #47

Earlier quoted context omitted.

Cloudflare MITMs your secure connections. If you get the cheaper Cloudflare options, it's really insecure.

Yes it does that and that will rule it out for some apps. An option for many sites is to configure CloudFlare in pass-through mode (no MITM) and then just switch it on when you are being DOS'd.

Is that even an option? Where is that setting?

Re: Web Developer Security Checklist

#68

Post by corobo »

Animats wrote: post #53
jgrahamc wrote: post #50

Earlier quoted context omitted.

We offer free origin certificates on any plan level (yes, including FREE). It's not 'really insecure' and you seem to imply that encryption costs more with Cloudflare. That's not true. https://blog.cloudflare.com/cloudflare-ca-encryption-origin/

Your data is in the clear within Cloudflare, and may even be in the clear between Cloudflare and the real host if you choose that option. You're trusting Cloudflare's security and Cloudflare's internal certificate authority. Hundreds or thousands of sites would be compromised if Cloudflare had a security breach. Like the one they had three months ago.[1] [1] https://techcrunch.com/2017/02/23/major-cloudflare-bug-leak…

> Your data is in the clear within Cloudflare

Just a heads up you're telling Cloudflare's CTO how Cloudflare works

Re: Web Developer Security Checklist

#69

Post by ianamartin »

aeronautic wrote: post #29
appcraf8 wrote: post #13

Earlier quoted context omitted.

Throw across your node work. I will try to replicate the same for RoR. :-)

When I post the implementation notes for Node, feel free to speak up with the RoR speak for that item and I'll add it in. Thank you.

I'd be happy to try and do a Python version of this. I'm most familiar with Pyramid, but Flask and Django would be a learning opportunity for me. Much of this advice I've already implemented in Pyramid.

Re: Web Developer Security Checklist

#70

Post by ianamartin »

aeronautic wrote: post #29
appcraf8 wrote: post #13

Earlier quoted context omitted.

Throw across your node work. I will try to replicate the same for RoR. :-)

When I post the implementation notes for Node, feel free to speak up with the RoR speak for that item and I'll add it in. Thank you.

I'd be happy to try and do a Python version of this. I'm most familiar with Pyramid, but Flask and Django would be a learning opportunity for me. Much of this advice I've already implemented in Pyramid.
Post reply on HN