Abstract

Document Sections

I. Introduction

II. Objective

III. Proposed Idea

IV. Related Works

V. Levels of User Authentication and Securing User Data

VI. Architecture

VII. Methods to Secure the Web Application

VIII. Implementation

IX. Results

X. Novelty

XI. Conclusion

Abstract:

     Website security is a major concern for large organizations as well as individual developers, the rarer the technology used the harder it becomes to come up with secure practices for developing a website. Vulnerabilities that are not fixed during development, and are deployed as such become easy targets for hackers. This could cause the company or the individual to lose a lot of money. It is not just the developers who are affected, end users who end up on vulnerable websites may get exposed to XSS attack which could compromise their system or an unsecured configuration of database system could lead to a potential data leak and hence the password of every registered user on the website is compromised, users who use the same password on multiple websites are affected the most The motivation for this paper comes from the fact that there is an overwhelming number of vulnerabilities in any application under development and every developer, experienced or not needs a starting point to patch these vulnerabilities that might have occurred in their application, this research provides the most common vulnerabilities which should be taken care of in any application and thus provide the much-needed starting point for developers. The objective of this paper is to design and develop a secure web application according to Open Web Application Security Project (OWASP) guidelines.

I. INTRODUCTION

A Web application (Web app) is an application program that is stored on a remote server and delivered over the Internet through a browser interface. A web application generally consists of three main parts –

 Front – End,

 Back – End and

 Database.

For this paper, the front-end has been made using HTML with ejs, for back-end NodeJS has been used and for the database MySQL has been used.The front end is used to display the main content of the webpage, it is usually the only thing that the client sees once the site is visited. If the website is static then only the front end is required.HTML is used to form the layout of the whole page, CSS is used to give styling to the page, and JavaScript is used to give logic to the page. Websites having only the frontend are prone to Cross-Site Scripting (XSS) injection attacks.

RESULTS
A. SQL – NodeJS is a relatively new backend language therefore automated vulnerability scanners don’t work well with most of the NodeJS applications. Manual testing of vulnerabilities is one of the ways to validate the security of the application.

With the advancement of wireless communication and mobile technologies, health-care industry utilizes these technologies in patient monitoring system, where the medical professional can monitor patient’s health from anywhere and anytime. The medical professional monitors various health conditions of a patient through wireless communication using the mobile and the sensor devices. The sensor devices sense the health information of the patient, and send it to the medical professional via a gateway node of the WMSN. Since the sensitive patient information is transmitted through an open channel, so there is a big concern of message security against various types of active and passive attacks. To make secure communication between medical professional and patient, user authentication with session key agreement protocols [1, 2, 3, 4, 5] are widely used. In such protocols, after sharing a common session key between the medical professional and the patient, information can easily be transmitted through open channel by encrypting the message with the session key. In such protocols, session key verification [6] is one of the important security aspects to get assurance about the establishment of the common and secret session key between different participants. In the literature, lots of user authentication and session key agreement protocols are designed using RSA cryptosystem [7], ECC system [8, 9], bilinear pairing [10], chaotic map [11], and hash function [12, 13, 14, 15, 16, 17, 18, 19]. As mentioned in [6], the ECC cryptosystem is more secure and efficient than the RSA system. In cryptography, the bilinear pairing is the most expensive operation than other operations and hence, it is not appropriate for resourceconstrained WMSN. On the other hand, the chaotic map is also more expensive compared with the hash function. It is known that hash function is most lightweight function and popularly used to design various cryptographic protocols for resource-constrained environments. In WMSN, sensor nodes are generally powered by small batteries and recharging of the nodes is problematic. In addition, mobile devices, such as PDAs and smartphones are not suitable to compute expensive operations due to low computing processor.