Web Security Records

Front

CSRF Cross-site request forgery
Client adds pseudo-random number, background verification
Verification Code
Middleman attack
SSL Certificate Encryption
XSS (cross-site Scripting attack) vulnerability, Microsoft character Verification (automatic)
Text Presentation encoding Processing
Make the text of the label display especially filter the script
Cookie HttpOnly
HttpOnly in the case of JS can not operate cookies, under certain circumstances can guarantee security
Domain settings
Cookie domain matching (domian match) Principle: domain-shaped cookies, such as. abc.com, are sent to all abc.com subdomain requests on port 80. otherwise not.
Minimize authorization
Secure enables this property, the browser only sends cookies in HTTPS requests
Cookie Basics
The name cannot contain special characters and can be transcoded after transcoding
Values can be transcoded or encrypted
Expires expiration Time, GMT format, no time to close the browser when automatically deleted,
Path allowed, "/" means full station
Domain subdomain,
Secure can only be accessed with HTTPS if enabled
HttpOnly script (Js,applet) cannot read to cookie information

Background

SQL injection
Precompiled statement, which is the data entered by the client as a parameter in SQL, not directly splicing
Turn off error display to avoid leaking program structure
Database Connection account permissions restrictions (separate database data additions and deletions)
File Upload
Suffix name judgment (restricted in picture format)
Determine the first two characters of a file, such as the first two binary characters of PNG 8950,jpg to Ffd8
Get width,height <=0 masking with picture class initialization
File Rename (default does not show directory, renamed, attacker is very accessible)
Certified Session Management
Password length, combination, encryption processing, 3 times after verification code, up to 5 times IP, payment password, SMS verification code
Session Expiration Time
Access Rights control
Background permission system, role-function point

Web Security Records