Simon Willison's Weblog: owasp

OWASP Top 10 2007-2017: The Fall of CSRF

2018-08-06T22:02:39+00:00

OWASP Top 10 2007-2017: The Fall of CSRF

I was surprised to learn recently that CSRF didn’t make it into the 2017 OWASP Top 10 security vulnerabilities (after featuring almost every year since the list started). The credited reason is that web frameworks do a good enough job protecting against CSRF by default that it’s no longer a top-ten problem. Defaults really do matter.

Tags: csrf, owasp, security

OWASP: XSS Prevention Cheat Sheet

2009-01-24T23:58:44+00:00

OWASP: XSS Prevention Cheat Sheet

Comprehensive set of rules for avoiding XSS—there’s a bit more to it than just escaping all output variables, since you have to take markup context in to account.

Tags: markup, owasp, security, xss

Hashing client-side data

2003-02-08T23:53:25+00:00

Via Scott, a clever PHP technique for ensuring data sent to the browser as a cookie or hidden form variable isn't tampered with by the user:

If you're expecting to receive data in a cookie or a hidden form field that you've previously sent to a client, make sure it hasn't been tampered with by sending a hash of the data and a secret word along with the data. Put the hash in a hidden form field (or in the cookie) along with the data. When you receive the data and the hash, re-hash the data and make sure the new hash matches the old one.

A further explanation and example code can be found in PHP and the OWASP Top Ten Security Vulnerabilities, a handy article describing how PHP coders can combat the top ten web application security problems highlighted by a recent report from OWASP. Incidentally, OWASP still haven't fixed the cross site scripting vulnerability on their own site, discovered by Tom Gilder several weeks ago.

Incidentally, while the hashing method is clever and should be nice and secure I personally advocate not sending the user any information unless absolutely necessary - use sessions and store sensitive data on the server instead. I suppose you could always use the hash to add an extra layer of security to the session identifier though.

Tags: hashing, owasp, php, scott-johnson, security

OWASP Security guide

2002-11-24T21:19:55+00:00

The Open Web Application Security Project (OWASP) have a free guide to building secure web applications, which covers a large range of common problems such as cross site scripting and SQL injection vulnerabilities. The report is a 60 page PDF and although I haven't had time to go through it yet it looks like an excellent read.

Tags: owasp, security, sql-injection