Your Quick-Start Web Application Security Checklist

When building a web application, keeping the data of you and your customers secure should be high on your list of priorities.

Unfortunately, not all web developers know about the best practices for cybersecurity — and if they do, they may not be bothered enough to spend time implementing them. According to recent surveys, 94% of web applications have at least one high-severity vulnerability, and 25% of them are susceptible to eight of the top 10 security flaws.

Leaving these vulnerabilities unpatched not only exposes your customers’ sensitive information, it puts your business at serious legal, financial and reputational risk.

For these reasons, developers need to pay close attention to the security of their websites.

In this blog post, we’ll discuss the 6 most important factors that you should take into account when practicing secure web development.

1. Authentication and Passwords

Most websites use passwords to differentiate user accounts, but not all of them do so securely. Test your application’s password change and reset functionality, and make sure that all passwords are sufficiently long and complex.

Consider using measures such as CAPTCHA and multi-factor authentication. These make it more difficult for hackers to brute-force their way in and use stolen passwords.

2. Authorization

Once users have logged in, you must make sure that they are prevented from accessing unauthorized data and files. For example, users should not be able to view an unauthorized web page simply by entering it into the browser.

Make sure that sessions expire after a period of time. Also be sure that your website’s cookies are set only for the appropriate domains.

3. Secure Transmission

SSL certificates are how websites create a secure connection between the website’s server and the user’s browser. Your site’s SSL certificate should be currently valid and not expired.

Web pages that send and receive sensitive information, such as login forms, should use HTTPS and not HTTP. Make sure that HTTPS is also used for transmitting credentials and session tokens.

4. Input Validation

Two of the biggest website security exploits, cross-site scripting and SQL injection, occur because many sites fail to validate the input that users enter. In both exploits, the attacker inserts malicious code as part of the input, which the website server then accidentally executes.

In order to guard against these two vulnerabilities, your web application should validate and sanitize all input from the user.

5. File Uploads

If your application allows users to upload files to the server, you need to validate and sanitize them just as you would with any other input. Create a whitelist and blacklist of acceptable and unacceptable file types, and scan all files for viruses and malware. Place limits on how large the file can be and how often users can upload them.

6. Denial of Service

Like a crowd of angry protesters outside a building, denial of service (DoS) attacks attempt to flood your application’s server with illegitimate traffic. They do it to bring it down and prevent legitimate users from accessing it.

Distributed DoS attacks, such as the 2016 Dyn attack, assault your servers with traffic from thousands of different machines, making it much harder to block the attackers. If your application is important enough to be the target of a DoS attack, consider using multiple data centers in different geographical locations and working with a dedicated DoS mitigation service.

Need Some Help?

Keeping your web apps secure is important, but it’s not always easy. Choosing to partner with a web application security expert can help keep your software secure without sacrificing functionality.

If you’d like some help on your next project, just let us know – we’re more than happy to help.