PDA

View Full Version : Writing secure applications - a suggestion for an advisory document



murrah
22 Dec 2007, 3:46 PM
Hi,

Like most Ext developers, I want to ensure that my application is as secure as possible. I would also like everyone else's applications to be secure so that there is a reduced possibility of some future popular Ext based web site allowing hackers to steal user's data with the consequence that the media goes into overdrive saying Ext is dangerous. This might cause us to lose users or at least make them nervous when they see the "Loading ..." message.

I stress that I recognise that there is nothing inherent in Ext that makes it more or less secure than any other client-side framework. It is just that we have chosen Ext as our environment so why not be proactive and educate Ext and non-Ext users as well?

As a new developer I have trawled through the net looking for info about making my site secure. I found some good info and some "bad" info and no detailed "advisory" that I could follow especially as it relates to Ajax etc. I think it is in all our interests to have such a document and it would add to Ext's already high standing if the considerable knowledge of the Ext developers and users was harnessed to create such a document for Ext and non-Ext users alike.

Perhaps such a document exists already - if so can someone point me at it please?

With that in mind, I wanted to start the discussion about such an advisory with the aim of collaboratively creating one. I imagine that it should be on the wiki but for now I thought a forum post was a good way to discuss it. The first step (in my mind) is to agree on the guiding principles. Once they are established, the document could provide some clear examples of how to implement the measures by providing some server-specific examples (Coldfusion, PHP, ASP, etc). Hopefully, this will reduce the number of insecure sites.

So, here is my start. Please suggest corrections and rewordings as appropriate. I am by no means an expert in this subject and that is why I want this information to be accurate.
-----------------------
Preamble:
As web developers we have a responsibility to protect our user's data. There are a number of potential security risks that you might create when writing a web site. The Ext Javascript framework is no more or less secure than any other client-side framework. The following information is provided in the belief that a better understanding of the potential security risks and the steps that can be taken to prevent exploitation of those risks will enhance the confidence of the general public when using web sites such as the ones that we create using Ext.

The risks:
The level of risk depends upon the kind of web site you are writing.

1. If your web site does not get any data from some kind of dynamic data store (eg a database or someother web server) and is not using a server side environment like Coldfusion or PHP or ASP, then you probably dont need any kind of security. (Is this a true statement?)

2. If your web site does get data from some kind of dynamic data store (eg a database or someother web server) you will want to take steps to protect that data store. For example, to stop someone corrupting or deleting the data. This is the case even if your web site does not have authenticated users - ie is open to anyone to use.

3. If your users do need to authenticate before using your web site then you will be using some kind of dynamic data store so see point 2 above. In addition, you will want to protect the data so that only legitimate users can access the data they are permissioned to see. Everyone else (including bots) should be "locked out".

Guiding principles:
These are the overall principles and are explained in more detail below.

Server-side:
1. Never trust data from a client (eg form variables or url parameters).
2. Always validate and clean incoming data before using the data (eg before committing to a database)
3. Make sure the data you send from your server is exactly what you intend to send.

Client-side:
1. Validate data as it is entered by the user. This will do nothing to make the site more secure since client-side validation can easily be circumvented but it will do two things:
a. enhance your user's experience of the site
b. if your client side validates that a field should be an integer (for example) and your server-side validation picks up a non-integer value for that field, either your validation failed or someone hacked around it. Either way, this is good information to know on your server-side.

2. If the data is not coming from your server, validate and clean before using it and especially before rendering it to avoid the risk of JS injection. If, for any reason, you cant trust your own server, you will need to treat your server as if it is a 3rd party provider and validate and clean that data before using it and especially before rendering it to avoid the risk of JS injection.

Suggested techniques:
To be written once the principles are agreed to. Possible headings are:


Using Ext to validate user input
Validating and cleaning data server side (examples/links for CF, PHP, ASP, etc)
Ensuring that server data is sent to legitimate users (examples/links for CF, PHP, ASP, etc)
User authentication and permissions (examples/links for CF, PHP, ASP, etc)
Using Ext to clean incoming data


etc...

Troy Wolf
26 Dec 2007, 1:19 PM
Murrah,

I think you bring up important things for developers to know and remember. However, as for making an Ext-specific security document, I think since Ext is a client-side development tool and as you point out almost all security related issues are server-side, it's not really something Ext should try to manage. Especially given the myriad server-side languages that can be used.

I think perhaps the one statement you made that is the most important security item that Ext could and should make clear is this:

Validate data as it is entered by the user. This will do nothing to make the site more secure since client-side validation can easily be circumvented...

We simply need to make sure people understand that client-side validation does not guarantee anything.

Ext is not exactly what I'd call a "beginner's tool" or "web dev 101". I think it's fairly safe to say that by the time a developer is using Ext to develop rich Internet apps, they should have already been exposed to the basic data-validation and authentication security issues. I'm sure there are exceptions, but we write docs for the masses--not the exceptions. ~o)

murrah
26 Dec 2007, 3:32 PM
I think since Ext is a client-side development tool and as you point out almost all security related issues are server-side, it's not really something Ext should try to manage. Especially given the myriad server-side languages that can be used.

Ext is not exactly what I'd call a "beginner's tool" or "web dev 101". I think it's fairly safe to say that by the time a developer is using Ext to develop rich Internet apps, they should have already been exposed to the basic data-validation and authentication security issues. I'm sure there are exceptions, but we write docs for the masses--not the exceptions. ~o)

Thanks Troy,
I was imagining that the proposed doc would have practical examples rather than theoretical discourse and I think that in the no-too-distant future Ext may well be be a starting point for beginner web developers. Also, we can all find examples of web sites written by experienced developers that have security issues.

My thoughts are that the client-side validation is related to the topic of data checking and "data security" and that this would make up a small but relevant part of such a document (mostly just examples) and there is an Ext-specific element to that.

The other areas that I think that examples would be useful is in the Ext side of user authentication client side, managing session management on the client side, checking any data that is coming from a 3rd party server, ensuring that you are sending / receiving data to your server and not to/from some other site. In my mind these topics could have some good examples of "best practice".

I guess in summary I would say I cant see any reason not to create such a document. Is there any downside that you can see given that you dont need to contribute if you dont want to? :)

Cheers,
Murray

hendricd
26 Dec 2007, 3:52 PM
@Murrah -- My reservation would be in achieving:
....could have some good examples of "best practice". within a reasonable time-frame. It would be great to hear everyones views on all that, but consensus won't come cheap. ;)

I'm just wondering if simply starting with some specific (yet generic enough) codefrags to demonstrate "what's possible and at what level" might be a good start.

murrah
26 Dec 2007, 6:29 PM
I'm just wonder if simply starting with some specific (yet generic enough) codefrags to demonstrate "what's possible and at what level" might be good start.

Yes, I think so. I guess I was just wanting to open the discussion at this general stage in case anyone had already done something like this elsewhere. I am not into re-inventing wheels!

Thanks,
Murray

hendricd
26 Dec 2007, 8:36 PM
@murrah - You've started an initiative (I'd guess) many of us would like to see more about. =D>

It'd be easier getting this moving starting out with methods people have already deployed or are currently tweaking rather than white-paper debates on concepts. Some "inline" references in code/docs would be valuable though.

This (http://extjs.com/forum/showthread.php?t=21681) may make implementing some of "what's to come" a little easier.

I'll help where I can.

pludikhu1
27 Dec 2007, 4:03 AM
Murrah

I couldn't agree more with this thread.
Among other things, it cannot be stressed enough that any client side validation (or even server side validation before Submit) must be repeated again after a submit.
I tried to stress that in my reply to this post by jsakalos (http://extjs.com/forum/showthread.php?t=19112) but I have the impression that I wasn't being understood.

Most of the examples on this site stop at Submit which is understandable for the reasons written by Troy Wolf.
But a joint effort to give server side code in the most used (and all other contributed) server side code would certainly be a good thing.
Because as you say, the last thing we want is a world full of 'secure' ExtJS front-ends with insecure back-ends.
I'm willing to contribute too but is a/this forum thread where we will want to do this?

Patrick
P.S. pludikhu (@Home) = pludikhu1 (@Work)

murrah
27 Dec 2007, 12:54 PM
I'm willing to contribute too but is a/this forum thread where we will want to do this?

Thanks Patrick,

Ultimately I think it should be in one of the wikis, probably the community manual? As far as authoring it goes, the discussion about the content is important. There is a Discussion tab on the wiki pages but that doesnt seem as convenient as the forum. I was thinking that we could develop the content in this post in sections then move the final content to the wiki.

What do you reckon?

Also, do you think that the Preamble, Risks and Guiding Principles as written in my original post are adequate?

Thanks,
Murray

murrah
27 Dec 2007, 1:15 PM
Thanks hendricd.

I will need some time to digest your Ajax extensions.

As a start on this "advisory", do you think that the Preamble, Risks and Guiding Principles as written in my original post are adequate?

And, do you have any suggestions for an ultimate home for it?

Thanks for your help,
Murray

hendricd
27 Dec 2007, 2:11 PM
As I intimated earlier, I fear "advisory" may be biting off too much -- relative to the position that forces the Ext-folks into.

Seems safer to advertise demonstrable approaches to common interests (that can easily be applied to Ext today).

What are they?
client-scrub,
server-scrub,
parameter encoding/encryption(nonSSL),
session-state management ?
... ???Explaining the "risks" section (#3 especially ) gets far-reaching, quickly. Authentication systems will vary and user-based permissioning is often too-closely tied to the back-end application logic to advertise it as "a generic approach we advise you to consider". ;) You may have noticed that may be why 'Examples/Extras' only has one working example of a loginForm tied to a server-script.

And, what about SOAP?
We don't even have a native, Ext-ized SOAP client yet that will work with all these "Same-Origin-Policy" restrictions. :( That alone requires one to think about an SOA/security framework in a whole new way.


And, do you have any suggestions for an ultimate home for it?Since you can't maintain an ideal (secure and scrubbed) session without careful server-side participation, we'd need to dive into myriad issues that come with each server-scripting platform. This board's original purpose would quickly become skewed. In short, no, I don't know of a hosting environment available for such a project.

murrah
27 Dec 2007, 2:50 PM
Thanks Doug,

You make some good points. I am pondering on how best to proceed.

Cheers,
Murray

hendricd
28 Dec 2007, 11:35 AM
Perhaps a google.group, but that could get out of hand as well. :-?

hendricd
3 Jan 2008, 10:47 PM
OK, start recruiting: http://extjs.com/forum/showthread.php?t=22116

There's interest out there, it's just difficult to package right now.

murrah
5 Jan 2008, 3:27 PM
Thanks Doug. I am working up my app that includes user authentication etc and will use that as the example for the security suggestions. Back later.

Cheers,
Murray