OWASP Cheat Sheets Martin Woschek,
[email protected] April 9, 2015 Contents I Developer Cheat Sheets (Builder) 11 1 Authentication Cheat Sheet 12 1.1 Introduction . 12 1.2 Authentication General Guidelines . 12 1.3 Use of authentication protocols that require no password . 17 1.4 Session Management General Guidelines . 19 1.5 Password Managers . 19 1.6 Authors and Primary Editors . 19 1.7 References . 19 2 Choosing and Using Security Questions Cheat Sheet 20 2.1 Introduction . 20 2.2 The Problem . 20 2.3 Choosing Security Questions and/or Identity Data . 20 2.4 Using Security Questions . 23 2.5 Related Articles . 25 2.6 Authors and Primary Editors . 25 2.7 References . 25 3 Clickjacking Defense Cheat Sheet 26 3.1 Introduction . 26 3.2 Defending with Content Security Policy frame-ancestors directive . 26 3.3 Defending with X-Frame-Options Response Headers . 26 3.4 Best-for-now Legacy Browser Frame Breaking Script . 28 3.5 window.confirm() Protection . 29 3.6 Non-Working Scripts . 29 3.7 Authors and Primary Editors . 32 3.8 References . 32 4 C-Based Toolchain Hardening Cheat Sheet 34 4.1 Introduction . 34 4.2 Actionable Items . 34 4.3 Build Configurations . 34 4.4 Library Integration . 36 4.5 Static Analysis . 37 4.6 Platform Security . 38 4.7 Authors and Editors . 38 4.8 References . 38 5 Cross-Site Request Forgery (CSRF) Prevention Cheat Sheet 40 5.1 Introduction . 40 5.2 Prevention Measures That Do NOT Work . 40 5.3 General Recommendation: Synchronizer Token Pattern . 41 5.4 CSRF Prevention without a Synchronizer Token .