5 ms·
Secure? Don't do it yourself. Use a library or a framework with security packages built-in.
by geoffreyhale 10y ago
Secure? Don't do it yourself. Use a library or a framework with security packages built-in.
- imh 10y agoI don't mean to implement security libraries myself. The problem is I don't even know what kinds of things to find libraries for.
- TACIXAT 10y agoYou'll want to look for front end libraries that have XSS mitigations built in. For cookies, at the most basic level, use an unguessable (secure random) value (more advanced is signing cookies, which some frameworks do so they can not be tampered with). Use CSRF tokens. Have a good content security policy. For backend / db, use prepared statements or object model frameworks. What it boils down to, never trust user input, never include user input in anything that resembles code before sanitization, validation, white listing, etc.