Безопасность web-приложений

Безопасность веб-приложений — доклад Олега Мохова
https://www.youtube.com/watch?v=HqUgIV2FMD8

Как предотвратить ваш сайт от атак повторного воспроизведения (How to Prevent Replay Attacks on Your Website)
https://www.sitepoint.com/how-to-prevent-replay-attacks-on-your-website/

X-XSS-Protectionhttps://www.keycdn.com/blog/x-xss-protection
– предотвращаем атаки межсайтового скриптинга (Preventing Cross-Site Scripting Attacks)

Запущен проект Observatory от Mozilla — он помогает разработчикам, администраторам и специалистам в области безопасности анализировать уровень защищённости сайтов и повышать его
https://www.pcworld.com/article/3112335/mozilla-launches-free-website-security-scanning-service.html
https://observatory.mozilla.org/

Security

Security and its twin sister Privacy have made quite a few headlines in the last few years: Heartbleed, Shellshock, DNCLeaks, and a rash of security breaches for many major online retailers. The consequence? Our personal information leaking out like sewage into the Dark Web.

Those of us building websites probably all need a better working knowledge of common attack vectors: XSS, CSRF, click-jacking, Social Engineering, etc. And how to defend against those dark arts: 

SSL

https://letsencrypt.org/ 

enable CORS

https://enable-cors.org/

 on both the client and server, strict 

Content Security Policies

https://content-security-policy.com/

, encrypting all sensitive data, and anonymizing any personally identifiable information (PII). We need to 2-factor authenticate everything. Our sites, its systems, its data, its settings need to be secure by default. Similar to how cars have seatbelts.

Designers may be quick to wring their hands of such a complex and technical responsibility as a problem for neckbeards to solve. However, Security and Privacy start with design. In a talk titled “How Designers Destroyed the World”, Mike Monteiro retells the story of a woman who’s sexual orientation was unintentionally revealed to her conservative father due to a flaw in Facebook’s privacy settings. Monteiro makes a convincing argument that situations like this are not a technical problem, they are a design problem.

https://vimeo.com/68470326

So Security and Privacy are actually all of our problems. Personally, I expect this space to heat up now that high profile political and corporate hacks are happening on the regular.

.NET Security — это просто

https://habrahabr.ru/company/jugru/blog/341792/

Как защитить веб-приложение: основные советы, инструменты, полезные ссылки

https://tproger.ru/translations/webapp-security/

                         

Уязвимости вашего приложения
https://habr.com/en/company/jugru/blog/349630/


Проверяем сайт на «вшивость»
https://vc.ru/flood/42317-proveryaem-sayt-na-vshivost


Быстрое введение в веб-безопасность

https://www.freecodecamp.org/news/a-quick-introduction-to-web-security-f90beaf4dd41/


Нас атакуют! 23+ лучших практик по безопасности Node.js

https://medium.com/@nodepractices/were-under-attack-23-node-js-security-best-practices-e33c146cb87d

nodejs: SSO-авторизация через Kerberos

https://www.pvsm.ru/node-js/243762?fbclid=IwAR2wXhJGgtXiJleG4Bfjm-WkC11FEggpVX00BzFjaML9bWJeIqoGr1ito20

Credentials Processes in Windows Authentication

https://docs.microsoft.com/en-us/windows-server/security/windows-authentication/credentials-processes-in-windows-authentication?fbclid=IwAR0PNIZNGGtUFxXtCaj_0DAOnQ4B3Ruwz_THALy-5tdKLfMrQtT9zk2D9h0

Single sign-on for HTTP requests using SPNEGO web authentication

https://www.ibm.com/docs/en/was-liberty/base?topic=authentication-single-sign-http-requests-using-spnego-web