مقاله انگلیسی رایگان در مورد توسعه امن وب با استفاده از دستورالعمل های OWASP – IEEE

Abstract

Document Sections

I. Introduction

II. Objective

III. Proposed Idea

IV. Related Works

V. Levels of User Authentication and Securing User Data

VI. Architecture

VII. Methods to Secure the Web Application

VIII. Implementation

IX. Results

X. Novelty

XI. Conclusion

Abstract:

     Website security is a major concern for large organizations as well as individual developers, the rarer the technology used the harder it becomes to come up with secure practices for developing a website. Vulnerabilities that are not fixed during development, and are deployed as such become easy targets for hackers. This could cause the company or the individual to lose a lot of money. It is not just the developers who are affected, end users who end up on vulnerable websites may get exposed to XSS attack which could compromise their system or an unsecured configuration of database system could lead to a potential data leak and hence the password of every registered user on the website is compromised, users who use the same password on multiple websites are affected the most The motivation for this paper comes from the fact that there is an overwhelming number of vulnerabilities in any application under development and every developer, experienced or not needs a starting point to patch these vulnerabilities that might have occurred in their application, this research provides the most common vulnerabilities which should be taken care of in any application and thus provide the much-needed starting point for developers. The objective of this paper is to design and develop a secure web application according to Open Web Application Security Project (OWASP) guidelines.

I. INTRODUCTION

A Web application (Web app) is an application program that is stored on a remote server and delivered over the Internet through a browser interface. A web application generally consists of three main parts –

 Front – End,

 Back – End and

 Database.

For this paper, the front-end has been made using HTML with ejs, for back-end NodeJS has been used and for the database MySQL has been used.The front end is used to display the main content of the webpage, it is usually the only thing that the client sees once the site is visited. If the website is static then only the front end is required.HTML is used to form the layout of the whole page, CSS is used to give styling to the page, and JavaScript is used to give logic to the page. Websites having only the frontend are prone to Cross-Site Scripting (XSS) injection attacks.

RESULTS
A. SQL – NodeJS is a relatively new backend language therefore automated vulnerability scanners don’t work well with most of the NodeJS applications. Manual testing of vulnerabilities is one of the ways to validate the security of the application.