Topic: checklist

Web app security checklist (Braindump)

John McCaffrey, Thursday, May 14, 2009 @ 3:21 pm

In Yesterday's post I said I'd put together a quick list of things to think about around web application security. This is by no means an exhaustive list, but its a set of categories and things I start to look at when doing a security assessment on an app.

Web Application Security Checklist
Account management

• Password management (validation, expiration, previous passwords, etc)
• Account lockout (number of tries, IP auditing, etc)
• Role management

Data management

• Don't Leak sensitive user info (SSNs, account numbers, other identity info) in URLs, cookies, sessions, logs, or printable pages.
• User Auditing (who changed what, and when)

Browser hacks

• Cross Site Scripting (XSS)
• Cross Site Request Forgery (XSRF)

Encrypted transport (make sure Ajax calls are secure)
Encrypted storage (credit cards, ssns, etc)
Server configuration (firewalls, web/app server, db)

I actually have a longer list, but its not formatted/organized very well,  so this is my first cut at sharing it with others.

What other areas do you look at when doing security checks for your web apps?

What tools do you use?

• Digg
• Reddit
• del.icio.us

Comments (5)

Software Development