Web Application Security

Website security must be thought about while building every level of the web stack. However, this section includes topics that deserve particular treatment, such as cross-site scripting (XSS), SQL injection, cross-site request forgery and usage of public-private keypairs.

Security tools

• lynis (source code) is a security audit tool that can run as a shell script on a Linux system to find out its vulnerabilities so that you can fix them instead of allowing them to be exploited by malicious actors.

• Charles is an HTTP proxy for inspecting headers, requests and responses for all traffic that flows through it.

• TLS Observatory provides a suite of security tools for analyzing and inspecting Transport Layer Security (TLS) services. There is also a hosted version you can use at observatory.mozilla.org.

• WIG contains tools for gathering wireless data via Wifi protocols.

• HTTP Evader is an automated testing tool for checking firewalls to ensure they are protecting the appropriate ports and payloads.

• Security monkey monitors for changes to AWS, Google Cloud, GitHub and other infrastructure systems.

Specific vulnerabilities

• httpoxy is a set of vulnerabilities that can affect Python web application servers via HTTP requests.

• Heartbleed is a vulnerability in OpenSSL implementations that must be patched for any systems you run otherwise you are at serious risk for data leakage.

• Meltdown and Spectre are x86 architecture problems caused by exploiting CPU branch-prediction implementations.

HTTPS resources

SSL over HTTP (HTTPS) is mandatory for securing web data traffic in transit. There is a page dedicated to HTTPS and the following resources can also give you a good overview of how HTTPS works.

• How does HTTPS actually work? is a well-written overview of the protocol including certificates, signatures, signing and related topics.

• These introduction to HTTPS videos explain what HTTPS is and how to implement it.

• This question asking what is the difference between TLS and SSL? explains that TLS is a newer version of SSL and should be used because SSL through version 3.0 is insecure.

• If you have wondered what all the SSL/TLS acronyms and settings mean, read the Security/Server Side TLS guide which Mozilla uses to operationalize its servers.

• If you're having users submit sensitive information to your site you need to use SSL/TLS. Anything before TLS is now insecure. Check out this handy guide that goes over some of the nuances of the subject.

• The Sorry State of SSL details the history and evolution of SSL/TLS. There are important differences between the versions and Hynek explains why TLS should always be used. The talk prompted work to improve Python's SSL in 2.7.9 based on the upgrades in Python 3 outlined in The not-so-sorry state of SSL in Python.

• How HTTPS Secures Connections is a guide for what HTTPS does and does not secure against.

• The first few milliseconds of an HTTPS connection provides a detailed look at the SSL handshake process that is implemented by browsers based on the RFC 2818 specification.

• Qualy SSL Server Test can be used to determine what's in place and what is missing for your server's HTTPS connection. Once you run the test read this article on Getting an A+ on Qualy's SSL Labs Tester to improve your situation.

General security resources

• The Open Web Application Security Project (OWASP) has cheat sheets for security topics.

• Stanford's CS253 class is available for free online, including lecture slides, videos and course materials to learn about web browser internals, session attacks, fingerprinting, HTTPS and many other fundamental topics.

• The SaaS CTO Security Checklist Redux is an awesome list of steps for securing your infrastructure and employees as well as what stage and size company it is recommended that you put those procedures in place.

• Reckon you've seen some stupid security things? Here, hold my beer... provides hilarious, and terribly sad, security vulnerabilities and weaknesses around encryption and password storage.

• This page contains a fantastic curated list of security reading material from beginning to advanced topics.

• How to protect your infrastructure against the basic attacker presents a good overview of what you need to think about when hardening your system against reasonablely competent malicious attackers.

• The /r/netsec subreddit is one place to go to learn more about network and application security.

• The EFF has a well written overview on what makes a good security audit. It's broad but contains some of their behind the scenes thinking on important considerations with security audits.

• Ubuntu system hardening guide provides step-by-step instructions for hardening the most recent three Ubuntu LTS releases.

• Ars Technica wrote posts on securing your website along with how to set up a safe and secure web server: part 1 and part 2 to explain HTTPS and SSL without much required pre-existing knowledge.

• Crypto 101 is an introductory course on cryptography for programmers.

• The first answer to the question "Why are salted hashes more secure for password storage?" on Stack Overflow gives a wonderful explanation for why this is an important technique to use to keep your database passwords and other secrets more secure if the hashed strings are leaked.

• Cloud Security Auditing: Challenges and Emerging Approaches is a high-level overview of some of security auditing problems that come with cloud deployments.

• Wondering how the common buffer overflow attack works? Check out this article on buffer overflows that explains the attack in layman's terms.

• 7 Security Measures to Protect Your Servers provides a good overview of the fundamentals for how servers should be configured for baseline security.

• As you're developing on Linux, you'll want to read and follow this Linux workstation security document to make sure your code and environment are not compromised. If you're on Mac OS X, check out this securing Yosemite guide which covers that environment.

• Timing attacks are one form of vulnerability that can be used to defeat HTTPS in certain configurations. Understanding how those attacks work is important in keeping your users' connections secure.

• Let's Encrypt at Scale shows an implementation for securing thousands of sites with SSL certificates to support HTTPS everywhere.

Web security learning checklist

1. Read and understand the major web application security flaws that are commonly exploited by malicious actors. These include cross-site request forgery (CSRF), cross-site scripting (XSS), SQL injection and session hijacking. The OWASP top 10 web application vulnerabilities list is a great place to get an overview of these topics.

2. Determine how the framework you've chosen mitigates these vulnerabilities.

3. Ensure your code implements the mitigation techniques for your framework.

4. Think like an attacker and actively work to break into your own system. If you do not have enough experience to confidently break the security consider hiring a known white hat attacker. Have her break the application's security, report the easiest vulnerabilities to exploit in your app and help implement protections against those weaknesses.

5. Recognize that no system is ever totally secure. However, the more popular an application becomes the more attractive a target it is to attackers. Reevaluate your web application security on a frequent basis.

What web development topic do you want to learn about next?