Riya Premarajan Vechiot
Yogita Vijay Biradar
- Research Scholar, MCA, Thakur Institute of Management Studies, Career Development & Research (TIMSCDR), Mumbai, Maharashtra, India
- Research Scholar, MCA, Thakur Institute of Management Studies, Career Development & Research (TIMSCDR), Mumbai, Maharashtra, India
Abstract
With incidents of cyber-attacks on websites and breaches of sensitive data on the rise, adopting secure coding or development practices to build strong web applications is long overdue. These practices encompass a variety of strategies, including but not limited to, input validation to prevent SQL injection and XSS attacks, secure session management, encryption of sensitive data, and the implementation of robust authentication and authorization mechanisms. This approach not only fortifies applications against known web vulnerabilities but also ingrains a culture of security within the development process. Drawing from a wealth of knowledge shared by industry professionals, this research work underscores the importance of incorporating these secure development practices from the outset. Furthermore, adopting a security-first mindset encourages the ongoing evaluation and updating of security measures to combat evolving cyber threats. This research work compiles insights from various sources by industry experts. Applying these practices at the development stage would result in applications that are not susceptible to known web application vulnerabilities.
Keywords: Web-security, web applications, best practices, vulnerability prevention, security-first development
[This article belongs to Journal of Web Engineering & Technology(jowet)]
References
- Alabdulrazzaq Haneen. Securing Web Applications: Web Application Flow Whitelisting to Improve Security. PhD Dissertation. Auburn, AL: Auburn University;
- Baars Nanne. (2018 May 22). Web Application Security: 10 Things Developers Need to Know. [Online]. www.youtube.com. youtu.be/qjrkV4RjgIU?si=ZIPfOCqWmNOqIj pr. Accessed 7 Oct. 2023.
- Beer E. (2022). Infosys leak: IT firm left AWS key exposed on PyPi since Feb 2021. [online] The Stack. Available from: https://www.thestack.technology/infosys-leak-aws-key-exposed-on-pypi/
- Marin Bratanov. (2019 Nov 06). First 5 Tips for Building Secure (Web) Apps. [Online]. Telerik Blogs. www.telerik. com/blogs/first-5-tips-for-building-secure-web-apps. Accessed 30 Oct. 2023.
- OWASP Cheat Sheet Series. Secrets Management Cheat Sheets. [Online]. cheatsheet series.owasp.org/cheatsheets/Secrets_Manage ment_Cheat_Sheet.html. Accessed 22 Oct. 2023.
- What Is a Web Application Firewall (WAF)? [Online]. www.f5.com/glossary/web-application- firewall-waf. Accessed 27 Oct. 2023.
- Haider A. (2023 Nov 16). Top 21 .NET Security Best Practices for Web Applications. [Online]. Clickysoft. Clickysoft. Available from: https://clickysoft.com/dot-net-security-best-practices/
- (2011). Can I fully prevent SQL injection by PDO Prepared statement without bind_param? [Online]. Stack Overflow. Available from: https://stackoverflow.com/questions/7915952/can-i-fully-prevent-sql-injection-by-pdo-prepared-statement-without-bind-param
- Gayatri R. (2020 May 23). Stored Cross-Site Scripting(Non-Privileged User to Anyone). [Online]. Medium. Available from: https://gaya3-r.medium.com/stored-cross-site-scripting-non-privileged-user-to-anyone-1754e0a053d6
Journal of Web Engineering & Technology
| Volume | 11 |
| Issue | 01 |
| Received | February 29, 2024 |
| Accepted | March 30, 2024 |
| Published | April 3, 2024 |