browser security

<< back to table of contents

Some concepts

• principle of least privilege/authority

  • each piece of an application should only have the least amount of privilege it needs in order to perform its task

• Should send and receive all data over secure channels--encrypt your data!

  • TLS/SSL

• secure your cookies

  • add a secure flag to headers when sending cookies so they can only be sent over HTTPS
  • add HTTP-only to headers

• only give users the option to access your site over HTTPS

  • set browser settings so that always redirects to HTTPS version

• public key pinning--'this certificate, and only this certificate, is valid for my domain'

  • generates hash from public key

• be wary of the security of third-party packages/dependencies

Cross-site scripting (XSS)

• escape inputs
• validate inputs
  • whitelisting: only allowing known good characters through
• sanitize inputs
  • use a library

Cross-site request forgery (CSRF)

• forces an end user to execute unwanted actions on a web application in which they're currently authenticated

How to prevent

• verify that the origin of a request and its target origin match by checking the origin header
• if origin header is not present, verify that the hostname in the referrer header matches the target origin

SQL injection