A Guide to Building Secure Web Applications and Web Services

2.1 (DRAFT 3) February 2006

OWASP Foundation

1 Frontispiece
2 Table of Contents

Frontispiece

Dedication

To my fellow procrastinators and TiVo addicts, this book proves that given enough “tomorrows,” anything is possible. Andrew van der Stock

Copyright and license

© 2001 – 2006 OWASP Foundation. The Guide is licensed under the Free Documentation License, a copy of which is found in the Appendix. PERMISSION IS GRANTED TO COPY, DISTRIBUTE, AND/OR MODIFY THIS DOCUMENT PROVIDED THIS COPYRIGHT NOTICE AND ATTRIBUTION TO OWASP IS RETAINED.

Editors

The Guide has had several editors over various editions, all of whom have contributed immensely as authors, project managers, and editors over the lengthy period of the Guide’s gestation. Guide 2.x series editors:

Andrew van der Stock Adrian Wiesmann

Authors and Reviewers

The Guide would not be where it is today without the generous gift of volunteer time and effort from many individuals. The following people helped develop Guide 2.x:

Abraham Kang Adrian Wiesmann Amit Klein Andrew van der Stock Brian Greidanus Christopher Todd Darrel Grundy Daniel Cornell David Endler Denis Pilipchuk Dennis Groves Derek Browne Eoin Keary Erik Lee Ernesto Arroyo Frank Lemmon Gene McKenna Hal Lockhart Izhar By-Gad Jeremy Poteet José Pedro Arroyo K.K. Mookhey Kevin McLaughlin Martin Eizner Michael Howard Michael Scovetta Mikael Simonsson Neal Krawetz Nigel Tranter Raoul Endres Ray Stirbei Richard Parke Robert Hansen Roy McNamara Steve Taylor Sverre Huseby Tim Smith William Hau

Revision History

Date Version Pages Notes July 26, 2005 2.0 Blackhat Edition 280 pages Andrew van der Stock, Guide Lead July 27, 2005 2.0.1 Blackhat Edition++ 293 pages Cryptography chapter review from Michael Howard incorporated September 12, 2005 2.1 DRAFT 1 X pages Changes from many sources New SQA chapter from Frank Lemmon January 2006 2.1 DRAFT 2 X pages Changes from Bill Pollock New chapters from Erick Lee New revisions from Dan Cornell February 2006 2.1 DRAFT 3 X pages Ajax chapter Many chapters back from reviewers

Date	Version	Pages	Notes
July 26, 2005	2.0 Blackhat Edition	280 pages	Andrew van der Stock, Guide Lead
July 27, 2005	2.0.1 Blackhat Edition++	293 pages	Cryptography chapter review from Michael Howard incorporated
September 12, 2005	2.1 DRAFT 1	X pages	Changes from many sources New SQA chapter from Frank Lemmon
January 2006	2.1 DRAFT 2	X pages	Changes from Bill Pollock New chapters from Erick Lee New revisions from Dan Cornell
February 2006	2.1 DRAFT 3	X pages	Ajax chapter Many chapters back from reviewers

Guide:Frontispiece

Frontispiece

Dedication

Copyright and license

Editors

Authors and Reviewers

Revision History

Table of Contents

ABOUT THE OPEN WEB APPLICATION SECURITY PROJECT

Structure and Licensing 13

Participation and Membership 13

Projects 14

INTRODUCTION

Developing Secure Applications 15

Improvements in this edition 15

How to use this Guide 16

Updates and errata 16

With thanks 16

WHAT ARE WEB APPLICATIONS?

Technologies 18

First generation – CGI 18

Filters 18

Scripting 19

Web application frameworks – J2EE and ASP.NET 20

Small to medium scale applications 21

Large scale applications 22

View 22

Controller 22

Model 23

Conclusion 24

POLICY FRAMEWORKS

Organizational commitment to security 25

OWASP’s Place at the Framework table 26

Development Methodology 28

Coding Standards 29

Source Code Control 29

Summary 30

SECURE CODING PRINCIPLES

Asset Classification 31

About attackers 31

Core pillars of information security 32

Security Architecture 32

Security Principles 33

THREAT RISK MODELING

Threat Risk Modeling 37

Performing threat risk modeling using the Microsoft Threat Modeling Process 37

Alternative Threat Modeling Systems 44

Trike 44

AS/NZS 4360:2004 Risk Management 44

CVSS 45

OCTAVE 46

Conclusion 47

Further Reading 47

HANDLING E-COMMERCE PAYMENTS

Objectives 49

Compliance and Laws 49

PCI Compliance 49

Handling Credit Cards 50

Further Reading 53

PHISHING

What is phishing? 55

User Education 56

Make it easy for your users to report scams 57

Communicating with customers via e-mail 57

Never ask your customers for their secrets 58

Fix all your XSS issues 58

Do not use pop-ups 59

Don’t be framed 59

Move your application one link away from your front page 59

Enforce local referrers for images and other resources 59

Keep the address bar, use SSL, do not use IP addresses 60

Don’t be the source of identity theft 60

Implement safe-guards within your application 61

Monitor unusual account activity 61

Get the phishing target servers offline pronto 62

Take control of the fraudulent domain name 62

Work with law enforcement 63

When an attack happens 63

Further Reading 63

WEB SERVICES