>- sanitizing input
Oh, that unicorn that everybody takes about, yet nobody does anything with it
So, how do you sanitize input?
you save in database escaped strings?
allow only "english" letters?
>- HTML injection
>- XSS
those two belong to
>- Escaping output
don't they?
>- Various timing attacks (eg password hashing)
>- How to store passwords
just use state of art auth/login handling libs?
>- DDoS and other resource exhaustion attacks
I don't think I'd add it there, isn't it handled by firewall / infrastructure than app directly?
Oh, that unicorn that everybody takes about, yet nobody does anything with it
So, how do you sanitize input?
you save in database escaped strings?
allow only "english" letters?
>- HTML injection
>- XSS
those two belong to
>- Escaping output
don't they?
>- Various timing attacks (eg password hashing)
>- How to store passwords
just use state of art auth/login handling libs?
>- DDoS and other resource exhaustion attacks
I don't think I'd add it there, isn't it handled by firewall / infrastructure than app directly?