1

I was trying to research on available secure coding guidelines of server-side and client-side languages.

There are online documentation from Oracle for Java, Microsoft for asp.net, and w3 for html5 to name a few. There were also third vendor guidelines from SEI, Veracode etc

For secure coding, should non-vendor documentation like Veracode be followed?

Will the parent vendor documentation (like Oracle, Microsoft, etc) miss any security guidelines that may be available in third vendor publications like veracode?

Do all scripts/programming languages have secure coding guidelines available? Is it mandatory for program or framework creators to release secure coding guidelines

  • 1
    Mandatory for what? In which context do you ask if A should B? – Birb Apr 24 '19 at 20:12
  • is it mandatory or a programming language to have a secure guideline – PDHide Apr 24 '19 at 21:39
  • Law does not mandate such a thing. It is just best practice for vendors to make one. – A. Hersean Apr 25 '19 at 7:47
  • I specially like the NIST guides wiki.sei.cmu.edu/confluence/display/seccode/…, have a look to them, they will help you – camp0 Oct 11 '19 at 15:10
0

Everybody is using OWASP these days or some standard based on it.

https://www.owasp.org/index.php/OWASP_Secure_Coding_Practices_-_Quick_Reference_Guide

Just to note, most of the security must be done on the server side. I.e. the data validation and sanitation, enforcement of the security of communication channels, authentication, authorization, and many many more. Only trusted libraries should be used and the code written should be reviewed by independent developers to prevent intended back doors.

Regarding the client side, remember to not to operate with the data you don't need on the client side at all (or encrypt them securely on the server side - i.e. session data/view states) and discard any sensitive or confidential data you don't need anymore immediately. If you use some sensitive or confidential data on the client side (and you obviously do, usually it is a session token and some kind of credentials), make sure you use the most secure methods available to store and transfer them but this hardly depends on the technology in use on the client side.

Of course, don't forget to protect the communication channel between client and server with some kind of encryption.

OWASP will tell you more.

| improve this answer | |
  • Everybody likes vanilla ice cream :p – Conor Mancone Mar 9 at 17:38
  • Actually, I don't ;) – Fis Mar 10 at 4:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.