Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

I've been developing intranet web sites and public web sites with no big issues concerning security. There were nothing to steal and nothing to gain. Nothing to attract people to try to reach the website behind the scene. I don't talk about login & password but more about the security against user attacks.

So, what's the best way to learn to secure the access to a site, to learn about common mistakes or weakness to think about ? Do I have to find a framework related to the language I use and rely on it or is there a source (book, website, ...) where I can find information about general design and tricks ?

share|improve this question
4  
Someone from Russia typed "); SELECT CCNumber, CCExp, CCCCV FROM Users;" in the search box of my 10.000 subscriber website ;) –  user2567 Dec 10 '10 at 12:22
3  
I think it is better to ask this question in the Security site : security.stackexchange.com –  M.H Dec 10 '10 at 12:27
    
@DA: I'm sure it actually happened and that the exploit was as simple than that. –  user2567 Dec 10 '10 at 12:28
3  
xkcd.com/327 –  NimChimpsky Dec 10 '10 at 12:32

4 Answers 4

up vote 3 down vote accepted

If you're doing web development with Java, consider reading up on the Spring Security framework (here is a good tutorial). It's based on Acegi Security which was absorbed into the Spring Framework. You'll quickly learn about the key principles of securing a web application:

  1. Never trust the client (validate everything)
  2. HTTPS is your friend
  3. Hashing passwords is a good thing
  4. Security is an aspect of your code (i.e implemented through filters and interceptors rather than directly within your business logic)

Anecdote

I remember one client I worked with who had employed a security firm to perform penetration tests on their code. They failed badly. One quick refactor to use Spring Security and Spring MVC instead of their home-grown approach and all their issues vanished.

Nothing is ever perfect, but you can make it so hard to get into your application that script kiddies give up leaving just the dedicated crackers to deal with. And for them, you'll need professional advice.

share|improve this answer

There's NEVER nothing to steal. Even if the data on your site is worthless, your processing time and bandwidth is still valuable to DDOS botnet operators. If you're running a computer on the internet and you're interested in being a good citizen, you have to be interested in security.

share|improve this answer
    
+1 for "bandwidth is valuable" - it most certainly is. –  Gary Rowe Dec 10 '10 at 13:26

Plan for your project security before you start coding, Not after.
Also There are very good answers on SO on many similar questions : Like this and this

share|improve this answer

You can learn about this by yourself, but a framework would help you avoid making common mistakes and be a lot more secure.

share|improve this answer
    
+1 for emphasising the use of a framework (not sure where the downvote on this came from - perhaps the downvoter could clarify the reason?). In general, frameworks have simplified most of the configuration and implementation details, but they still need to be studied carefully since they are not silver bullets. –  Gary Rowe Dec 10 '10 at 13:28

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.