This guide attempts to provide a comprehensive overview of web application security. Common web application security issues and methods how to prevent them are explained. Web server and operating system security are not covered. The guide is intended mainly for web application developers, but can also provide useful information for web application reviewers.

The checklist gives a short summary containing only the individual guidelines. It is recommended to take the time and read the full version, where the guidelines are explained in detail, especially if any questions arise.

Most web application developers probably (hopefully) already know some or even most of the points mentioned in this guide. However, there will probably be something new for every developer. Remember, as a developer it is your responsibility to develop your application securely, and a single mistake may be enough to allow an attack.

Contents

A printable version of this Web Application Security Guide is available. (edit it)

• Checklist
• Topics
  1. Miscellaneous points
  2. File inclusion and disclosure
  3. File upload vulnerabilities
  4. SQL injection
  5. Cross-site scripting (XSS)
  6. XML and internal data escaping
  7. XML, JSON and general API security
  8. (Un)trusted input
  9. Cross-site request forgery (CSRF)
  10. Clickjacking
  11. Insecure data transfer
  12. Session fixation
  13. Session stealing
  14. Truncation attacks, trimming attacks
  15. Password security
  16. Comparison issues
  17. PHP-specific issues
  18. Prefetching and Spiders
  19. Special files
  20. SSL, TLS and HTTPS basics
• Further reading
• Authors

The print version provides the entire book on a single page.