Secure coding standards and guidelines

Question

I was trying to research on available secure coding guidelines of server-side and client-side languages.

There are online documentation from Oracle for Java, Microsoft for asp.net, and w3 for html5 to name a few. There were also third vendor guidelines from SEI, Veracode etc

For secure coding, should non-vendor documentation like Veracode be followed?

Will the parent vendor documentation (like Oracle, Microsoft, etc) miss any security guidelines that may be available in third vendor publications like veracode?

Do all scripts/programming languages have secure coding guidelines available? Is it mandatory for program or framework creators to release secure coding guidelines

Answer 1

Everybody is using OWASP these days or some standard based on it.

https://www.owasp.org/index.php/OWASP_Secure_Coding_Practices_-_Quick_Reference_Guide

Just to note, most of the security must be done on the server side. I.e. the data validation and sanitation, enforcement of the security of communication channels, authentication, authorization, and many many more. Only trusted libraries should be used and the code written should be reviewed by independent developers to prevent intended back doors.

Regarding the client side, remember to not to operate with the data you don't need on the client side at all (or encrypt them securely on the server side - i.e. session data/view states) and discard any sensitive or confidential data you don't need anymore immediately. If you use some sensitive or confidential data on the client side (and you obviously do, usually it is a session token and some kind of credentials), make sure you use the most secure methods available to store and transfer them but this hardly depends on the technology in use on the client side.

Of course, don't forget to protect the communication channel between client and server with some kind of encryption.

OWASP will tell you more.