Securing Web-Based Services

Chapter 12

Securing Web-Based Services

It s now time to turn our attention to what is potentially the most hostile of all environments: the Web. In this chapter, we ll focus on making sure that applications that use the Web as a transport mechanism are safe from attack. Much of this book has focused on non-Web issues; however, a good deal of the content is relevant for securing Web-based applications. For example, cryptographic mistakes and the storage of secrets covered in Chapter 6, Cryptographic Foibles, and Chapter 7, Storing Secrets, respectively as well as other aspects of this book relate to Web-based applications. But the subject definitely deserves its own chapter.

While I was researching background material in preparation for this chapter, it became obvious that one of the most common mistakes made by all vendors of Web-based servers and Web-based applications is trusting users to send well-formed, nonmalicious data. If Web-based application designers can learn to not trust user input and to be stricter about what is considered valid input, fewer Web applications will be compromised. Because of these common security issues, a large portion of this chapter focuses on Web-specific canonicalization issues and safe ways to manipulate user input. I ll also discuss other common mistakes made by Internet Server Application Programming Interface (ISAPI) application and filter developers, and then I ll wrap up with cookies issues and storing secrets in Web pages.