3 ms·
A couple security issues after a quick look: > No secure flag set on your session cookie > No HttpOnly flag or secure flag set on auth-token cookie > Passwor
by amckenna 12y ago
A couple security issues after a quick look:
> No secure flag set on your session cookie
> No HttpOnly flag or secure flag set on auth-token cookie
> Password reset doesn't require the old password
> Password policy requires only 6 characters
> No x-frame-options header (especially problematic with 3rd item)
> You're running sslstrip on port 10250
> You're MongoDB port is open to the internet
> No support for TLS 1.1 or 1.2
> Info is "encrypted" but keys are kept server side. You may not keep the URL after generation but it's still sitting in your server logs. Look at mega's use of strings after # for how to do client side only keys.
- pcl 12y agoThis is a great list. I wish I could vote it up more than once. Do you maintain a full checklist publicly anywhere? I've seen some great checklists from security review teams in the past (iSec Partners, for example), but I don't know what their re-sharing policy is.
- amckenna 12y agoThanks! Unfortunately I don't have a checklist of sorts. Most of what check for is just from habit and memory. I have a project I'm working on that will involve putting one together but that's still a few months out. If I remember I will shoot it over to you!
- blahed 12y agoThanks for the audit, super helpful. We should probably roll our cert too.
- brianmwaters_hn 12y agoAnother one: you guys are using a DV certificate, which is really less than ideal for an app like this, that needs to be trusted by its users.