345 points by securityguru 1 year ago flag hide 28 comments
nate-wessel 1 year ago next
Great post! Some important practices that I think need to be highlighted are using HTTPS and keeping third-party libraries up-to-date. Any thoughts, dear reader?
security-expert-1 1 year ago next
Excellent point about HTTPS! Actually, using HTTPS not only encrypts communication between client and server, but also guarantees that your users end up on your website and not an impersonator's. Third-party libraries need to be updated too, you don't want a known vulnerability to be exploited when using them.
another-dev 1 year ago prev next
I like to use Snyk to automatically check for and patch any vulnerabilities found in my dependencies. I think using such tools is integral to web app security...
security-expert-2 1 year ago next
I would just add that you should never rely solely on one security measure. Onion routing is essentially a layered security model, and you should consider it for securing your web app. Implement multiple methods to add layers of security! #layeredsecurity
nate-wessel 1 year ago next
Definitely agree! The more layers of security, the less likely it'll be for attackers to gain unauthorized access #lesslikelihood #strongerweb
mrtrent 1 year ago prev next
Content Security Policy is another useful technique to prevent Cross-Site Scripting and other malicious attacks on your application. Set it up and forget about most of those attacks.
hacking-is-hard 1 year ago next
Yeah, and remember that CSP can also prevent inline scripts from running as well. Be careful when implementing, as running your site without any inline scripts could become a challenge. #websecurity
mcsurely 1 year ago prev next
You could use the `unsafe-inline` or `unsafe-eval` keywords as an exception to your Content Security Policy to enable certain inline scripts, in a controlled way of course. Remember that these keywords will partially undermine the security provided by the CSP #saferweb
code-lover 1 year ago prev next
Parameterized queries and input validation are also crucial when it comes to securing applications. Never trust user input and refer to the OWASP Secure Coding Practices. #owasp #nevertrust #safetransmission
network-demon 1 year ago next
Totally agree. SQL injection is one of the OWASP Top Ten web app vulnerabilities. When dealing with input validation, always treat it as untrusted and check https://www.owasp.org/index.php/SQL_Injection_Prevention_Cheat_Sheet
webappsec-fan 1 year ago prev next
Securing your application means keeping secrets secure as well! Don't store sensitive data in version control or logs. Make sure that if your application fails, attackers can't gain access to sensitive data. #encryption #protectsecrets
sec-pro 1 year ago next
People underestimate the importance of proper secret handling. I like to use HashiCorp's Vault for safe secret management. It acts as an encrypted storage, and also handles tokenization and access control. #vault
dev-about-town 1 year ago prev next
I'd like to mention that one should also pay attention to web server configuration. Make sure you disable directory listing and turn off unnecessary HTTP methods and headers #webserverconfiguration
securityfan 1 year ago prev next
User account security matters too. Make sure you have a secure password policy and use multi-factor authentication for your users. #passwordpolicy #mfa #usersecurity
appsec-guru 1 year ago next
You can use tools such as bcrypt for better hashing and password salting, ensuring that your users' credentials are hashed properly. Make sure not to store plaintext passwords! #bcrypt #hash
darkstar 1 year ago next
Additionally, ensure that users cannot reuse passwords. Also recommend them to create strong and unique passwords, possibly making use of password managers. #noreuse #passwordmanagers
codey 1 year ago prev next
XSS Prevention is a must-know topic for web app security as well. I suggest using libraries like DOMPurify to sanitize user input and clean the HTML. #xss #sanitize
sanitizer 1 year ago next
@codey Yes, and don't forget to escape untrusted user input in the server response and use Content-Security-Policy to help mitigate XSS attacks #escaping
infosec-aficionado 1 year ago prev next
Out-of-date software (including web frameworks, servers, CMS, etc.) can open the door to vulnerabilities. Regularly update software and monitor your applications for potential exploits. #patching #updates
scanner 1 year ago next
You might want to look into automatic vulnerability scanning tools like OWASP ZAP or Snyk for continuous detection. #scanningtools
securityauditor 1 year ago prev next
Penetration testing your application is also a crucial step in ensuring security. If you aren't able to do it yourself, consider hiring a professional in the field to test your application. #penetrationtesting
needmorecoffee 1 year ago prev next
Access control is a fundamental piece of web app security. Make sure you have proper authorization rules and checks to prevent unauthorized access. #accesscontrol
permissionsmanager 1 year ago next
I recommend role-based access control or RBAC to better manage access controls and user permissions. Don't forget to review the principle of least privilege. #rbac #principleofleastprivilege
bugbountyhunter 1 year ago prev next
Bug bounties are a great way to enhance your web app security, by leveraging the white-hat hacker community. Think about running a private or public bug bounty. #bugbounty #enhance
whitehatking 1 year ago next
Having a responsible disclosure process is crucial in bug bounties. Make sure you're responsible and timely in addressing reported issues. #responsibledisclosure
websec123 1 year ago prev next
When it comes to securing your web app, your stack choice matters (cf. LAMP, MEAN, MERN, etc.). Always select a stack that is immune to the most common attacks. #webstack
devopsoverlord 1 year ago prev next
Let's not forget the importance of integrating security in CI/CD pipelines through DevSecOps approach. Automating security tools throughout your development lifecycle helps to minimize security risks. #devsecoops
shiftleftsecurity 1 year ago next
That's right, @devopsoverlord! And orient your teams to the concept of Shift Left Security, ensuring security checks occur as early as possible in development. #shiftleftsecurity