11

What are the most important security features that a web-based CMS should offer? What's vital? What would be nice to have? What features should the CMS not attempt to do?

Please note: I'm looking more for specific features that enhance security rather than just the basics like validating input, escaping input and output, XSS protection, SQL injection prevention, not showing errors, etc.

Improve this question
2
  • 2
    You're confusing two different aspects. To make it clearer, you want to have security features and not secure features. Please note that there is a big difference between secure features (correctly implemented features) and security features (features which should enhance security)
    – Henri
    Commented Nov 14, 2010 at 12:42
  • I wasn't confusing them, but you stated it better than I did. Thank you.
    – VirtuosiMedia
    Commented Nov 14, 2010 at 18:07

3 Answers 3

Reset to default
5
Improve this answer
3
  • +1, excellent reply. Wrt the first point (ACL security) - since most CMS are usually aimed lower-end, I think it would be better to simplify and go for RBAC (Role based access control), but also provide the ACL if required. Also, if this is intended as a business CMS, there should definitely be hooks to ActiveDirectory, SIEM, SMS, etc.
    – AviD ♦
    Commented Nov 14, 2010 at 2:30
  • @AviD - Can you clarify the difference between RBAC and ACL?
    – VirtuosiMedia
    Commented Nov 14, 2010 at 18:18
  • @VirtuosiMedia, I did better than that - since I thought that would be a great question to seed the beta site with, I went ahead and asked it -security.stackexchange.com/questions/346. That way you get the best of the community, not just my own explanation :)
    – AviD ♦
    Commented Nov 14, 2010 at 19:44
5

If you need to handle users's passwords make sure to not store them in plain text and be sure to salt them first.

Improve this answer
2

I know that it's not widely used but I've always thought that it would be a nice feature for a user to be able to upload their PGP public key so that emails generated by the CMS can be encrypted. Kind of related, any generated passwords that are sent via email should be time-limited one-time use only (i.e. the password allows the user to log in for 24 hours and then they have to change their password)

Updated: I was lying awake last night and for some reason this topic popped back into my head. Any login should be HTTP Digest Authentication or a form-based login with client-side HMAC if SSL can't be used. Basic auth and raw password form actions are a no-no!

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .