Should tutorials be expected to teach people sufficient security? Should code snippets be production-ready to put on the Internet for the general public? I tend to think not. Is this just me?
So here's a partial list of issues you'd need to deal with:
- sanitizing input
- Escaping output
- SQL injection
- HTML injection
- XSS
- CSRF
- CORS
- Clickjacking
- DDoS and other resource exhaustion attacks
- Various timing attacks (eg password hashing)
- How to store passwords
- Depending on language, buffer overflows
That's... a lot. You can take this even further: you should assume you're going to get compromised at some point. What are you going to do to detect a breach? Or an active attempt to find a breach? What's your strategy for handling a breach?
Here's an analogy: we can tell you how to treat Poison Ivy without having to add a disclaimer that you're not qualified to be an attending dermatologist.
So here's a partial list of issues you'd need to deal with:
- sanitizing input
- Escaping output
- SQL injection
- HTML injection
- XSS
- CSRF
- CORS
- Clickjacking
- DDoS and other resource exhaustion attacks
- Various timing attacks (eg password hashing)
- How to store passwords
- Depending on language, buffer overflows
That's... a lot. You can take this even further: you should assume you're going to get compromised at some point. What are you going to do to detect a breach? Or an active attempt to find a breach? What's your strategy for handling a breach?
Here's an analogy: we can tell you how to treat Poison Ivy without having to add a disclaimer that you're not qualified to be an attending dermatologist.