I'm writing a web application which will be able to send signed and encrypted emails to someone else outside my trust boundary. It will also retrieve S/MIME encrypted (and maybe also signed) emails from different accounts.
What security precautions do I need to make?
More specific questions:
- Is there a need to implement any kind of input validation (for the emails received). The attachment will be stored in a database and accessible via the web UI.
- What about output sanitization? As the email will be encrypted and signed, is there a strong need to do anything with the contents before?