Slashdot Mirror

← Back to Stories (view on slashdot.org)

A Guide to Building Secure Web Applications

Posted by michael on from the much-needed-little-heeded dept.

some-guy writes "The Open Web Application Security Project has released A Guide to Building Secure Web Applications, Version 1.1 "While this document doesn't provide a silver bullet to cure all the ills, we hope it goes a long way in taking the first step towards helping people understand the inherent problems in web applications and build more secure web applications and Web Services in the future...""

2 of 126 comments (clear)

  1. For those of you using PHP in particular... by angst7 · · Score: 5, Informative

    As a supplimentary reading assignment, this months Linux Journal is running an similar, interesting article on Programming PHP with Security in Mind.

    ---
    Jedimom.com, choo choo choosing you...

    --
    StrategyTalk.com, PC Game Forums
  2. "click through" by Conare · · Score: 5, Informative

    Any security mechanism should be designed in such a way that when it fails, it fails closed. That is to say, it should fail to a state that rejects all subsequent security requests rather than allows them

    This is one of my favorites. Most browsers fail SSL connections with a warning that allows the user to just "click through" if the certificate is expired, does not match the DNS name of the site, or is issued by an untrusted authority. Only the last of these should be a warning (since you may want to trust it anyway. The other two should be connection failures. I am glad they included this.

    --
    Stop Continental Drift! Reunite Gondwanaland!