A practical security guide for web developers
Had this SO link saved since probably soon after it was asked 7 years ago. Still relevant and still being updated.http://stackoverflow.com/questions/549/the-definitive-guide-...Includes:- How to log in- How to remain logged in- Managing cookies (including recommended settings)- SSL/HTTPS encryption- How to store passwords- Using secret questions- Forgotten username/password functionality- Use of nonces to prevent cross-site request forgeries..........And much much more.