Scribd Logo
Upload

Welcome to Scribd!

  • 27 views

    Understanding Security, and Some Best Practices

    Uploaded by

    Roy Silvester
    This document discusses security best practices for modern web application development. It covers securing the front-end from JavaScript vulnerabilities, using HTTPS for network security and preventing man-in-the-middle attacks. On the backend, it recommends authenticating and authorizing all API requests, sanitizing all user input, using libraries for cryptography instead of custom code, and regularly updating software. The document also provides tips for secure development practices like separate environments, non-cleartext logging and restricting database access.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd

    Understanding Security, and Some Best Practices

    Uploaded by

    Roy Silvester
    27 views11 pages
    This document discusses security best practices for modern web application development. It covers securing the front-end from JavaScript vulnerabilities, using HTTPS for network security and preventing man-in-the-middle attacks. On the backend, it recommends authenticating and authorizing all API requests, sanitizing all user input, using libraries for cryptography instead of custom code, and regularly updating software. The document also provides tips for secure development practices like separate environments, non-cleartext logging and restricting database access.

    Original Description:

    Modern Mobile api liberaries

    Original Title

    Apis

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    This document discusses security best practices for modern web application development. It covers securing the front-end from JavaScript vulnerabilities, using HTTPS for network security and preventing man-in-the-middle attacks. On the backend, it recommends authenticating and authorizing all API requests, sanitizing all user input, using libraries for cryptography instead of custom code, and regularly updating software. The document also provides tips for secure development practices like separate environments, non-cleartext logging and restricting database access.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    27 views11 pages

    Understanding Security, and Some Best Practices

    Uploaded by

    Roy Silvester
    This document discusses security best practices for modern web application development. It covers securing the front-end from JavaScript vulnerabilities, using HTTPS for network security and preventing man-in-the-middle attacks. On the backend, it recommends authenticating and authorizing all API requests, sanitizing all user input, using libraries for cryptography instead of custom code, and regularly updating software. The document also provides tips for secure development practices like separate environments, non-cleartext logging and restricting database access.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    of 11

    Module 14

    Understanding security, and some best practices

    Introduction to Modern Application Development

    Dr Gaurav Raina (IIT Madras), Tanmai Gopal (Hasura)

    Objectives
    -

    How attacks happen


    Understanding major attack surfaces
    Front-end
    -

    Network level
    -

    Open APIs

    Database level
    -

    Man-in-the-middle

    API/development level
    -

    Javascript execution

    SQL injection

    System level
    -

    Incorrect logs, Server vulnerabilities that allow remote code execution

    Introduction to Modern Application Development

    Dr Gaurav Raina (IIT Madras), Tanmai Gopal (Hasura)

    Common loopholes that cause security breaches


    -

    Edge cases missed out by the developer OR breaking a developers (incorrect) assumptions
    Developer forgets to add an authentication/authorization check to an API endpoint
    http://thenextweb.com/insider/2015/03/23/how-i-hacked-indias-biggest-startup/
    Being able to execute code where it should not be allowed
    Upload a file (PHP) instead of uploading an image
    Going to that path where the image is stored: http://site.com/images/file.php will execute the source code of
    the file instead of serving the image unless the directory or apache are configured to not allow execution of
    any files inside the images directory
    Being able to access unauthorized data
    Production access was not supposed to be given to tester.
    So tester credentials were not stored very secretly
    Hacker got access to tester credentials, was able to access production database
    Denial of service
    An attack that aims to make a network or server software component unavailable to its users
    Make so many requests to a site, that normal users cant reach the site
    Social engineering, or even being stupid
    We might have very secure systems. But if we are not careful about where keys/passwords/credentials are
    stored, then there is no point.

    Introduction to Modern Application Development

    Dr Gaurav Raina (IIT Madras), Tanmai Gopal (Hasura)

    Architecture of a webapp

    Web server
    Network

    Introduction to Modern Application Development

    Browser
    (web client)

    request

    Computer (host)

    Vulnerabilities in
    webapp source code
    Vulnerabilities in OS,
    or libraries being used

    response

    1. Reading traffic
    between client and
    server to capture data
    2. DOS attacks on
    network components
    3. Man-in-the-middle
    attacks

    Vulnerability in:
    1. webapp source code
    2. The browser

    Dr Gaurav Raina (IIT Madras), Tanmai Gopal (Hasura)

    Webapp front-end code


    -

    Users (and hackers) have full access to your front-end code


    That means that you cant store any secret data, or credentials to your code
    You are dependent on the browser to provide security to your webapp
    Eg: Chrome browser extensions can ask the user for permissions to read/modify data on the webapp
    That means that if there is a malicious extension, it can extract your session-id from your webapps cookies
    and send them somewhere else
    Include safe javascript libraries from safe locations
    If you include a 3rd party javascript file in your webapp source code, you are giving that javascript file full
    access to do anything on the webapp
    A <script> tag in the HTML will be executed by the browser: (XSS attacks)
    Validate user-input while sending or while displaying
    If you are showing comments written by your user, make sure that the HTML is templated successfully.
    For eg: What if I type a comment: <script>alert(Hello);</script> as a comment on a flipkar product? Every
    time someone loads the product page, and my comment is loaded, the alert box will load. Now image if Im a
    bad person.
    Follow best practices:
    Update libraries you use frequently
    Ask your users to stay on the latest browsers

    Introduction to Modern Application Development

    Dr Gaurav Raina (IIT Madras), Tanmai Gopal (Hasura)

    Network security
    -

    The network is not owned by you (the developer).


    So anything can happen: Man-in-the-middle-attack
    End-to-end encryption is the only way to secure data as it is in transit from the browser to the server
    HTTPS is secured HTTP with end to end encryption by using SSL certificates installed on the server
    (SSH is also end to end encrypted)
    This means that if anyone gets hold of the data as it is enroute from the client to the server, the data will be
    gibberish
    However, even the endpoint is not guaranteed to be safe (MITM attack)
    If you are connecting to a server (say google.com) how do you know if that server is actually google.com?
    Verified SSL certificates are installed on the server
    For every HTTPS connection, the browser checks the cross-verifies the SSL certificate signature given to it
    with a Certificate Authority that the browser trusts
    What CAs does a browser trust? Its a part of the browser itself! You can add your own trusted CAs if you
    want to
    Summary: Always use HTTPS wherever possible!

    Introduction to Modern Application Development

    Dr Gaurav Raina (IIT Madras), Tanmai Gopal (Hasura)

    Network security

    Introduction to Modern Application Development

    Dr Gaurav Raina (IIT Madras), Tanmai Gopal (Hasura)

    API/Webapp development
    -

    Make sure every API/page request has:


    Authentication: Check if the user is actually who the user claims to be (token user-id)
    Authorization: Check if the user has access to the particular API/page
    Sanitize all input that users send:
    If youre expecting users to send data of a particular type, verify that it is actually that type
    Try to write as little code as possible, while leveraging mature libraries written by the (open-source)
    community
    Do not implement your own hashing algorithm
    Do not store any credentials, tokens or configuration data in your source code
    Exchange these credentials with your developers only if required, and that too over secure channels
    Eg: Lastpass
    Configuration data/credentials (like database username/password) should only be present in a file on the
    server machine. It can be put there manually; not automatically copied there while copying the code
    Update server-side software, OS, and source code dependencies regularly

    Introduction to Modern Application Development

    Dr Gaurav Raina (IIT Madras), Tanmai Gopal (Hasura)

    API/Webapp development
    -

    Make sure every API/page request has:


    Authentication: Check if the user is actually who the user claims to be (token user-id)
    Authorization: Check if the user has access to the particular API/page
    Sanitize all input that users send:
    If youre expecting users to send data of a particular type, verify that it is actually that type
    Try to write as little code as possible, while leveraging mature libraries written by the (open-source)
    community
    Do not implement your own hashing algorithm
    Do not store any credentials, tokens or configuration data in your source code
    Exchange these credentials with your developers only if required, and that too over secure channels
    Eg: Lastpass
    Configuration data/credentials (like database username/password) should only be present in a file on the
    server machine. It can be put there manually; not automatically copied there while copying the code
    Update server-side software, OS, and source code dependencies regularly

    Introduction to Modern Application Development

    Dr Gaurav Raina (IIT Madras), Tanmai Gopal (Hasura)

    Best development/deployment practices


    -

    Dont log secure information


    Dont print out sensitive information as log output from your server-side code
    Eg: In your login API endpoint, dont print out the username/password as logs
    Why? Because if anyone gets access to the logs, then its like getting access to the database
    Separate staging (testing) & production environment
    Dont execute any file/source-code that is not guaranteed to be from the development team
    Use secure methods like SSH (not FTP) to manage your servers
    Preferably set up key based access and not just password access

    Access the database safely


    -

    Separate admin users from read/write users from read users


    Dont execute raw SQL statements on the database if any part of that SQL statement depends on user-input
    SQL injection attacks
    Use mature libraries and frameworks to connect to a database that automatically escape the SQL for you.

    Introduction to Modern Application Development

    Dr Gaurav Raina (IIT Madras), Tanmai Gopal (Hasura)

    Key takeaways
    -

    Each point in this module!


    Try to understand why each point is the way it is by getting into more detail

    Introduction to Modern Application Development

    Dr Gaurav Raina (IIT Madras), Tanmai Gopal (Hasura)

    You might also like