Is this really the version you are looking for? Kentico Xperience 8.1 Documentation is no longer updated. Use the switcher in the header to choose your product version.
This is a design checklist – things you should keep in mind while developing websites.
Check | Description |
|---|---|
User inputs are checked for type, length and content. | |
User inputs with arithmetic operations are checked and validated for minimum and maximum values. | |
All user inputs are validated on server side as well as on client side. | |
Values stored in hidden form fields are validated properly. |
Check | Description |
|---|---|
Cross-site scripting | |
User inputs are escaped and validated. | |
Content is encoded before it is rendered on a page. | |
Strings from external sources are encoded using the HTMLHelper.HTMLEncode() method. | |
URL parameters are sanitized using the QueryHelper.GetText() method. | |
Values from external sources rendered as part of JavaScript code are encoded using ScriptHelper.GetString(). | |
Cookies are configured as http-only. | |
SQL injection | |
SQL parameters are used for dynamic parts of SELECT, INSERT, UPDATE and DELETE queries. | |
The exec() function is not used in SQL code. | |
Cross-site request forgery | |
Actions are performed using POST requests, not GET. | |
View state mac validation is enabled globally in the web.config file. XML | |
LDAP injection | |
User inputs for LDAP queries are sanitized before execution. | |
Check | Description |
|---|---|
User accounts are secured against all types of attacks. | |
Error messages in the UI are configured so that they show only basic information and the whole information is logged only into the Event log. | |
File upload | |
Name, length, type and content of files is checked upon file upload. | |
Logging | |
All critical activities in the website are logged. | |
The website does not allow unhandled exceptions to occur. | |