Tell me more ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.
up vote 2183 down vote favorite
1728

What things should a programmer implementing the technical details of a web application consider before making the site public? If Jeff Atwood can forget about HttpOnly cookies, sitemaps, and cross-site request forgeries all in the same site, what important thing could I be forgetting as well?

I'm thinking about this from a web developer's perspective, such that someone else is creating the actual design and content for the site. So while usability and content may be more important than the platform, you the programmer have little say in that. What you do need to worry about is that your implementation of the platform is stable, performs well, is secure, and meets any other business goals (like not cost too much, take too long to build, and rank as well with Google as the content supports).

Think of this from the perspective of a developer who's done some work for intranet-type applications in a fairly trusted environment, and is about to have his first shot and putting out a potentially popular site for the entire big bad world wide web.

Also, I'm looking for something more specific than just a vague "web standards" response. I mean, HTML, JavaScript, and CSS over HTTP are pretty much a given, especially when I've already specified that you're a professional web developer. So going beyond that, Which standards? In what circumstances, and why? Provide a link to the standard's specification.

share|improve this question
show 2 more comments

migrated from stackoverflow.com Feb 11 '11 at 16:28

73 Answers

1 2 3
up vote 2 down vote

Add a DOCTYPE! (any doctype!) to your pages to ensure you are rendering in Standards Mode.

<!doctype>
<html>
  ...
</html>

This simple tag determines whether your site renders in "Quirks Mode" or "Standards Mode" and makes a world of difference in how browsers determine how to render your pages, and how JavaScript is interpreted. Saving you hours and hours of hair pulling.

e.g. without a doctype:

  • Internet Explorer will apply broken, buggy behaviors to document.getElementById(id)
  • Internet Explorer will (when this gets fixed in IE10) not render contents set by setting the .innerHTML on <table>, <thead>, <tbody>, tfoot, <tr>, and <select> elements
  • Browsers will include borders and padding in widths/heights
  • Internet Explorer will ignore CSS for white-space:pre
  • many more... http://www.quirksmode.org/css/quirksmode.html
share|improve this answer
up vote 1 down vote

The most important thing for a web site developer to know is that there really is no such thing as a standard. The standards exist, but are often ignored or are incorrectly implemented.

The only way to know if your pages are going to operate correctly on all web browsers is to try it on every browser you can find: IE, Firefox, Opera, Safari, and Chorme for a start.

So, yes, of course, use standard practices. But then test and remove those features which do not work across all browsers.

share|improve this answer
show 1 more comment
up vote 1 down vote

Know how to resist session highjacking. Http_only is only one aspect of this, and not necessarily the most likely for some threat models (it applies when people can insert html onto your site).

There are session highjacking attacks which are regarded as remotely executable by NIST, and exploits are in the wild today. Here are some refs:

http://fscked.org/projects/cookiemonster

CVE-2002-1152

share|improve this answer
up vote 1 down vote

Site design and development with thinking of localization feature for other languages.

share|improve this answer
up vote 1 down vote

Take a look at a good web usability book, e.g. Don't Make Me Think: A Common-Sense Approach to Web Usability, by Steve Krug.

share|improve this answer
up vote 1 down vote

If you are going to accept user input, learn input validation. This is the biggest thing that programmers make mistakes on, they accept user input in random location and it allows script kiddies to come along and remote include a file that then gives them full control over your local machine.

"Be lenient in what you accept, but strict in what you output"

However, don't trust any user generated input in any way shape or form. Don't trust it!

share|improve this answer
up vote 1 down vote

Even though there are many things to consider here you should not neglect the performace of the website,especially the loading time. This can be achieved through caching,gzip.deflate compression etc. Check a list of things you must do for faster website at the below url 7 steps to Speed up website loading – Website Optimization Tips -Part 1

share|improve this answer
up vote 1 down vote

If for some reason you don't trust Google or you want to have more control over the collected data, try Piwik as analysis tool. It is open source and extensible via plugins.

share|improve this answer
up vote 1 down vote

This is something I just recently discovered, but if you are building a site that you want to be social media friendly, consider adding Open Graph meta tags to your site. When users share a URL on Facebook (or other social networking site that parses these) this lets you control the URL, thumbnail, title and description.

On the same note, consider adding widgits to your pages that encourage users to share / promote your site on social media sites. Some worth mentioning are the AddThis widget and the Facebook Like Button.

share|improve this answer
show 1 more comment
up vote 1 down vote

Understanding how:

  • SSL works
  • PKI works
  • Cookies are used to manage sessions
share|improve this answer
show 1 more comment
up vote 0 down vote

  • One of the key things is to understand how you are going to debug your system. This means understanding the 'big picture'. So know your environment (O/S, database, framework, networking et al) and at least know where to 'look' if you have ten users each calling with their on issue even if you did not write all that server side code.

  • Often times, good user interface design (error logging with the right amount of detail, log levels, hooks to display some details on demand) will go a long way.

share|improve this answer
up vote 0 down vote

Make sure someone in the organization already has the content maintenance, ongoing SEO and marketing plan worked out fully. Because if they haven't, they're going to default to you to provide all of those things (possibly with little compensation).

share|improve this answer
up vote -1 down vote

All of the above are great technical answers. I agree with most if not all... Some of the advice is business based and some of it is more independent based.

The one thing that I learned the hard way in creating public web sites, is don't half ass it!

Sure you may get visitors to look and interact with your site if you follow the mantra of "if you build it they will come", but now with some much out online, you should really make it the best that it possibly can be. It should do what it says it does and you need to constantly be tweaking it and making it better. You need to also know how to market your site using the different tools out there (i.e Facebook, and Twitter).

I've had several public sites that were OK, however, they never were great. Facebook and Google and Amazon all filled a need, more than likely your public sites will be niche so you won't have the luxury of people complaining about certain things while they wait for you to fix it (i.e Facebook). Make it great from the beginning (even if it takes longer), and you will be rewarded later.

Just my 2 cents.

share|improve this answer
1 2 3

protected by Yannis Rizos♦ Jun 9 '12 at 8:44

This question is protected to prevent "thanks!", "me too!", or spam answers by new users. To answer it, you must have earned at least 10 reputation on this site.

Not the answer you're looking for? Browse other questions tagged or ask your own question.