345 points by securityguru 6 months ago flag hide 28 comments
nate-wessel 6 months ago next
Great post! Some important practices that I think need to be highlighted are using HTTPS and keeping third-party libraries up-to-date. Any thoughts, dear reader?
security-expert-1 6 months ago next
Excellent point about HTTPS! Actually, using HTTPS not only encrypts communication between client and server, but also guarantees that your users end up on your website and not an impersonator's. Third-party libraries need to be updated too, you don't want a known vulnerability to be exploited when using them.
another-dev 6 months ago prev next
I like to use Snyk to automatically check for and patch any vulnerabilities found in my dependencies. I think using such tools is integral to web app security...
security-expert-2 6 months ago next
I would just add that you should never rely solely on one security measure. Onion routing is essentially a layered security model, and you should consider it for securing your web app. Implement multiple methods to add layers of security! #layeredsecurity
nate-wessel 6 months ago next
Definitely agree! The more layers of security, the less likely it'll be for attackers to gain unauthorized access #lesslikelihood #strongerweb
mrtrent 6 months ago prev next
Content Security Policy is another useful technique to prevent Cross-Site Scripting and other malicious attacks on your application. Set it up and forget about most of those attacks.
hacking-is-hard 6 months ago next
Yeah, and remember that CSP can also prevent inline scripts from running as well. Be careful when implementing, as running your site without any inline scripts could become a challenge. #websecurity
mcsurely 6 months ago prev next
You could use the `unsafe-inline` or `unsafe-eval` keywords as an exception to your Content Security Policy to enable certain inline scripts, in a controlled way of course. Remember that these keywords will partially undermine the security provided by the CSP #saferweb
code-lover 6 months ago prev next
Parameterized queries and input validation are also crucial when it comes to securing applications. Never trust user input and refer to the OWASP Secure Coding Practices. #owasp #nevertrust #safetransmission
network-demon 6 months ago next
Totally agree. SQL injection is one of the OWASP Top Ten web app vulnerabilities. When dealing with input validation, always treat it as untrusted and check https://www.owasp.org/index.php/SQL_Injection_Prevention_Cheat_Sheet
webappsec-fan 6 months ago prev next
Securing your application means keeping secrets secure as well! Don't store sensitive data in version control or logs. Make sure that if your application fails, attackers can't gain access to sensitive data. #encryption #protectsecrets
sec-pro 6 months ago next
People underestimate the importance of proper secret handling. I like to use HashiCorp's Vault for safe secret management. It acts as an encrypted storage, and also handles tokenization and access control. #vault
dev-about-town 6 months ago prev next
I'd like to mention that one should also pay attention to web server configuration. Make sure you disable directory listing and turn off unnecessary HTTP methods and headers #webserverconfiguration
securityfan 6 months ago prev next
User account security matters too. Make sure you have a secure password policy and use multi-factor authentication for your users. #passwordpolicy #mfa #usersecurity
appsec-guru 6 months ago next
You can use tools such as bcrypt for better hashing and password salting, ensuring that your users' credentials are hashed properly. Make sure not to store plaintext passwords! #bcrypt #hash
darkstar 6 months ago next
Additionally, ensure that users cannot reuse passwords. Also recommend them to create strong and unique passwords, possibly making use of password managers. #noreuse #passwordmanagers
codey 6 months ago prev next
XSS Prevention is a must-know topic for web app security as well. I suggest using libraries like DOMPurify to sanitize user input and clean the HTML. #xss #sanitize
sanitizer 6 months ago next
@codey Yes, and don't forget to escape untrusted user input in the server response and use Content-Security-Policy to help mitigate XSS attacks #escaping
infosec-aficionado 6 months ago prev next
Out-of-date software (including web frameworks, servers, CMS, etc.) can open the door to vulnerabilities. Regularly update software and monitor your applications for potential exploits. #patching #updates
scanner 6 months ago next
You might want to look into automatic vulnerability scanning tools like OWASP ZAP or Snyk for continuous detection. #scanningtools
securityauditor 6 months ago prev next
Penetration testing your application is also a crucial step in ensuring security. If you aren't able to do it yourself, consider hiring a professional in the field to test your application. #penetrationtesting
needmorecoffee 6 months ago prev next
Access control is a fundamental piece of web app security. Make sure you have proper authorization rules and checks to prevent unauthorized access. #accesscontrol
permissionsmanager 6 months ago next
I recommend role-based access control or RBAC to better manage access controls and user permissions. Don't forget to review the principle of least privilege. #rbac #principleofleastprivilege
bugbountyhunter 6 months ago prev next
Bug bounties are a great way to enhance your web app security, by leveraging the white-hat hacker community. Think about running a private or public bug bounty. #bugbounty #enhance
whitehatking 6 months ago next
Having a responsible disclosure process is crucial in bug bounties. Make sure you're responsible and timely in addressing reported issues. #responsibledisclosure
websec123 6 months ago prev next
When it comes to securing your web app, your stack choice matters (cf. LAMP, MEAN, MERN, etc.). Always select a stack that is immune to the most common attacks. #webstack
devopsoverlord 6 months ago prev next
Let's not forget the importance of integrating security in CI/CD pipelines through DevSecOps approach. Automating security tools throughout your development lifecycle helps to minimize security risks. #devsecoops
shiftleftsecurity 6 months ago next
That's right, @devopsoverlord! And orient your teams to the concept of Shift Left Security, ensuring security checks occur as early as possible in development. #shiftleftsecurity