Web Security Constraints

Web Security Constraints

A security exception is a special animal. Deal with it differently

Exceptions should be intercepted and translated prior to display

Deal with security exceptions differently

Security exceptions should be environment aware (unit, test, prod)

All get and post URLs should have security constraints associated with them


NoConstraint: public
LoginConstraint: login required
UserConstraint: A specific user login required
RoleConstraint: A specific role required
ObjectAccessConstraint: A specific object constraint
ObjectState: A specific state in which that object is allowed to be read/updated.

The URL constraints should be verifiable

All inputs to URLs validated

such as objects created out of database calls.

Examine every URL for client side and serverside division of variables

Show caution of using client side variables

like reading multiple lines in a properties file. You may leave something by mistake and you will not know the error.

This is less likely a problem in xml based configuration files but is in properties files

Every developer should have a checklist on their desk

Every developer should have an extra day just to do this

Testing should get a list of all URLs and their constraints

I suspect that this check list (not the URLs) will be as high as 50 to a 100

This goes to show it is very very very time consuming to build a secure site from ground up!!

A framework that captures and forces this metadata may be an option, like a typed language!