1

I was trying to research on available secure coding guidelines of server-side and client-side languages.

There are online documentation from Oracle for Java, Microsoft for asp.net, and w3 for html5 to name a few. There were also third vendor guidelines from SEI, Veracode etc

For secure coding, should non-vendor documentation like Veracode be followed?

Will the parent vendor documentation (like Oracle, Microsoft, etc) miss any security guidelines that may be available in third vendor publications like veracode?

Do all scripts/programming languages have secure coding guidelines available? Is it mandatory for program or framework creators to release secure coding guidelines

4
  • 1
    Mandatory for what? In which context do you ask if A should B?
    – Birb
    Apr 24, 2019 at 20:12
  • is it mandatory or a programming language to have a secure guideline
    – PDHide
    Apr 24, 2019 at 21:39
  • Law does not mandate such a thing. It is just best practice for vendors to make one.
    – A. Hersean
    Apr 25, 2019 at 7:47
  • I specially like the NIST guides wiki.sei.cmu.edu/confluence/display/seccode/…, have a look to them, they will help you
    – camp0
    Oct 11, 2019 at 15:10

1 Answer 1

1

Everybody is using OWASP these days or some standard based on it.

https://www.owasp.org/index.php/OWASP_Secure_Coding_Practices_-_Quick_Reference_Guide

Just to note, most of the security must be done on the server side. I.e. the data validation and sanitation, enforcement of the security of communication channels, authentication, authorization, and many many more. Only trusted libraries should be used and the code written should be reviewed by independent developers to prevent intended back doors.

Regarding the client side, remember to not to operate with the data you don't need on the client side at all (or encrypt them securely on the server side - i.e. session data/view states) and discard any sensitive or confidential data you don't need anymore immediately. If you use some sensitive or confidential data on the client side (and you obviously do, usually it is a session token and some kind of credentials), make sure you use the most secure methods available to store and transfer them but this hardly depends on the technology in use on the client side.

Of course, don't forget to protect the communication channel between client and server with some kind of encryption.

OWASP will tell you more.

2
  • 1
    Everybody likes vanilla ice cream :p Mar 9, 2020 at 17:38
  • Actually, I don't ;)
    – Fis
    Mar 10, 2020 at 4:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .