I'm reading through Mozilla's Secure Coding Guidelines, and found this statement:
Don't trust any user data (input, headers, cookies etc). Validate it before using it
I'm using the codeigniter framework, and am using the following (mostly built-in functions) for inputs and cookies:
- global xss filtering is set to TRUE
- CSRF protection is set to enabled
- cookies are flagged as secure
- cookies are flagged HTTPOnly
- cookies are encrypted
Headers. This is where I'm running into an issue. How do I protect my site against header injection? Haven't been able to figure this out.
Also, while I am validating user inputs like passwords, etc., am wondering if there is some other type of validation that needs to be done?