Take the 2-minute tour ×

I am looking for easy steps that are simple and effective in making a web application more secure.

What are your top tips for secure web applications, and what kind of attack will they stop?

share|improve this question
add comment

9 Answers

up vote 10 down vote accepted

Microsoft Technet has en excellent article:


Here are the topics for the tips answered in that article:

  1. Never Directly Trust User Input
  2. Services Should Have Neither System nor Administrator Access
  3. Follow SQL Server Best Practices
  4. Protect the Assets
  5. Include Auditing, Logging, and Reporting Features
  6. Analyze the Source Code
  7. Deploy Components Using Defense in Depth
  8. Turn Off In-Depth Error Messages for End Users
  9. Know the 10 Laws of Security Administration
  10. Have a Security Incident Response Plan
share|improve this answer
I especially love tip no. 10! Admittedly, never have thought about it before. –  Filip Dupanović Oct 15 '10 at 18:16
add comment

Do not trust user input.

Validation of expected data types and formatting is essential to avaoiding SQL injection and Cross-Site Scripting (XSS) attacks.

share|improve this answer
add comment
  1. Escape user provided content to avoid XSS attacks.
  2. Using paremeterised SQL or stored procedures to avoid SQL Injections attacks.
  3. Running the webserver as an unprivilaged account to minimise attackes on the OS.
  4. Setting the webserver directories to an unprivilaged account, again, to minimise attackes on the OS.
  5. Setting up unprivilaged accounts on the SQL server and using them for the application to minimise attacks on the DB.

For more in depth information, there is always the OWASP Guide to Building Secure Web Applications and Web Services

share|improve this answer
add comment

Related stack overflow question:

Checklist for Web Site Programming Vunerabilities


share|improve this answer
add comment

Some of my favourites:

  1. Filter Input, Escape Output to help guard against XSS or SQL injection attacks
  2. Use prepared statements for database queries (SQL injection attacks)
  3. Disable unused user accounts on your server to prevent brute force password attacks
  4. Remove Apache version info from HTTP header (ServerSignature=Off, ServerTokens=ProductOnly)
  5. Run your web server in a chroot jail to limit damage if compromised
share|improve this answer
+1 to 'filter input' as opposed to escaping. Never try to massage user's invalid input. –  normanatashbar Nov 10 '11 at 4:51
add comment

Set the secure flag on cookies for SSL applications. Otherwise there is always a highjacking attack that is much easier to conduct than breaking the crypto. This is the essence of CVE-2002-1152.

share|improve this answer
add comment

OWASP is your friend. Their Top Ten List of web application security vulnerabilities includes a description of each problem and how to defend against it. The site is a good resource for learning more about web application security and is a wealth of tools and and testing techniques as well.

share|improve this answer
add comment

The Web Application Hacker's Handbook, is a great starting point.

share|improve this answer
add comment

never ever ever ever trust user input

share|improve this answer
add comment

Your Answer


