LII:Web Application Security Guide/Checklist - Revision history

Shawndouglas: Updated.

2016-08-10T22:06:14Z

Updated.

Shawndouglas: /* XML, JSON and general API security */ Links

2016-08-10T21:42:33Z

XML, JSON and general API security: Links

← Older revision		Revision as of 21:42, 10 August 2016
Line 58:		Line 58:
	==XML, JSON and general API security==		==XML, JSON and general API security==
	* Ensure proper access control to the API		* Ensure proper access control to the API
	* Do not forget that you need to [[Web Application Security Guide/Cross-~~site_scripting_~~(XSS)\|correctly escape all output to prevent XSS attacks]], that data formats like XML require [[Web Application Security Guide/XML and internal data escaping\|special consideration]], and that protection against [[Web Application Security Guide/Cross-~~site_request_forgery_~~(CSRF)\|~~Cross~~-site request forgery (CSRF)]] is needed in many cases.		* Do not forget that you need to [[LII:Web Application Security Guide/Cross-site scripting (XSS)\|correctly escape all output to prevent XSS attacks]], that data formats like XML require [[LII:Web Application Security Guide/XML and internal data escaping\|special consideration]], and that protection against [[LII:Web Application Security Guide/Cross-site request forgery (CSRF)\|cross-site request forgery (CSRF)]] is needed in many cases.
	* Use standard data formats like JSON with proven libraries, and use them correctly. This will probably take care of all your escaping needs.		* Use standard data formats like JSON with proven libraries, and use them correctly. This will probably take care of all your escaping needs.
	* Make sure browsers do not misinterpret your document or allow cross-site loading		* Make sure browsers do not misinterpret your document or allow cross-site loading

Shawndouglas: /* Special files */ Missing link

2016-08-10T21:41:44Z

Special files: Missing link

← Older revision		Revision as of 21:41, 10 August 2016
Line 152:		Line 152:
	* Ensure crossdomain.xml and clientaccesspolicy.xml do not exist unless needed		* Ensure crossdomain.xml and clientaccesspolicy.xml do not exist unless needed
	* If used, ensure crossdomain.xml and clientaccesspolicy.xml allow access from trusted domains only		* If used, ensure crossdomain.xml and clientaccesspolicy.xml allow access from trusted domains only
	* Prevent users from uploading/changing special files		* Prevent users from uploading/changing special files (see [[LII:Web Application Security Guide/File upload vulnerabilities\|file upload vulnerabilities section]])

	==SSL, TLS and HTTPS basics==		==SSL, TLS and HTTPS basics==

Shawndouglas: Created as needed.

2016-08-10T19:37:01Z

Created as needed.

← Older revision		Revision as of 19:37, 10 August 2016
Line 1:		Line 1:
			{{TOC right}}
	==Miscellaneous points==		==Miscellaneous points==
	* Do '''not''' rely on Web Application Firewalls for security (however, consider using them to improve security)		* Do '''not''' rely on Web Application Firewalls for security (however, consider using them to improve security)

Shawndouglas: Created as needed.

2016-08-10T19:24:48Z

Created as needed.

Show changes

Shawndouglas: Transcluded, per John

2016-08-10T18:30:31Z

Transcluded, per John

New page

{{wikibooks::Web Application Security Guide/Checklist}}
==Notes==
This article is a direct transclusion of [https://en.wikibooks.org/wiki/Web_Application_Security_Guide/Checklist the Wikibooks article] and therefore may not meet the same editing standards as LIMSwiki.