Simple ways to improve the security of a web app

#1

Post by mdirolf » Thu, Dec 08, 2011, 12:41 AM UTC

Simple ways to improve the security of a web app
blog.fiesta.cc

Re: Simple ways to improve the security of a web app

#2

Post by rwolf » Thu, Dec 08, 2011, 3:52 AM UTC

I came in swinging to tear apart yet another oblivious security article, but you actually taught me something.

Looking up X-Frame-Options and X-Content-Security-Policy now--thanks!

Re: Simple ways to improve the security of a web app

#3

Post by ajtaylor » Thu, Dec 08, 2011, 4:18 AM UTC

I had never heard of these HTTP headers before. Thank you for the pointers.

Re: Simple ways to improve the security of a web app

#4

Post by cmer » Thu, Dec 08, 2011, 4:59 AM UTC

This is one of the best article I've seen in a long time! Great job Mike and best of luck with your new startup!

Re: Simple ways to improve the security of a web app

#5

Post by mdirolf » Thu, Dec 08, 2011, 6:08 AM UTC

cmer wrote: post #4

This is one of the best article I've seen in a long time! Great job Mike and best of luck with your new startup!

Thanks!

Re: Simple ways to improve the security of a web app

#6

Post by mdirolf » Thu, Dec 08, 2011, 6:09 AM UTC

rwolf wrote: post #2

I came in swinging to tear apart yet another oblivious security article, but you actually taught me something. Looking up X-Frame-Options and X-Content-Security-Policy now--thanks!

Glad you enjoyed it.

Re: Simple ways to improve the security of a web app

#7

Post by mdirolf » Thu, Dec 08, 2011, 6:10 AM UTC

ajtaylor wrote: post #3

I had never heard of these HTTP headers before. Thank you for the pointers.

No problem - I definitely recommend reading the linked Mozilla docs on them.

Re: Simple ways to improve the security of a web app

#8

Post by makmanalp » Thu, Dec 08, 2011, 6:39 AM UTC

http://www.theregister.co.uk/2011/06/21/startssl_security_br...

Yeah, fuck that. Like hell am I going to use a free CA as suggested. They have no incentive to keep things secure or in working order at all.

Great article otherwise though!

Re: Simple ways to improve the security of a web app

#9

Post by dtwwtd » Thu, Dec 08, 2011, 6:44 AM UTC

Chrome 15+ supports CSP. In 15 it uses an old syntax I believe but if you use 16+ then you should be able to use the same headers as in Firefox.

I didn't realize FF had CSP working as well. Thanks!

Re: Simple ways to improve the security of a web app

#10

Post by mdirolf » Thu, Dec 08, 2011, 6:50 AM UTC

dtwwtd wrote: post #9

Chrome 15+ supports CSP. In 15 it uses an old syntax I believe but if you use 16+ then you should be able to use the same headers as in Firefox. I didn't realize FF had CSP working as well. Thanks!

Good to know - thanks. More support is better, but the thing I really like about CSP is how it is still useful as a canary even with only partial browser support.