3 ms·
I don't mean to implement security libraries myself. The problem is I don't even know what kinds of things to find libraries for.
by imh 10y ago
I don't mean to implement security libraries myself. The problem is I don't even know what kinds of things to find libraries for.
- TACIXAT 10y agoYou'll want to look for front end libraries that have XSS mitigations built in. For cookies, at the most basic level, use an unguessable (secure random) value (more advanced is signing cookies, which some frameworks do so they can not be tampered with). Use CSRF tokens. Have a good content security policy. For backend / db, use prepared statements or object model frameworks. What it boils down to, never trust user input, never include user input in anything that resembles code before sanitization, validation, white listing, etc.