AS-3.8 Secure Coding Manage cookies securely if cookies are used: Continued and Systems Use the attribute with cookies “Secure” Use the attribute with cookies “HttpOnly” Use the attribute with cookies “Domain” Use the attribute with cookies “Path” Use non-persistent attributes (e.g., “Expires”, with cookies Avoid using the same cookie names for different paths or domain scopes inside the same application AS-3.9 Implement controls to prevent SQL injection. Use prepared statements Use stored procedures Escape all user-supplied input Minimize the privileges assigned to every database account in the environment Validate using whitelisting AS-3.10 Implement controls to prevent unvalidated redirects Avoid using redirects and forwards URL and forwards. Do not allow the user to input the URL if redirects must be used Ensure the supplied URL is valid if user input cannot be avoided Sanitize input using whitelisting if URL input must be allowed AS-3.11 Implement controls to prevent connections from Refuse all connections to any part of the application, if the anonymity networks (e.g., Tor, Freenet, Netshade), if IP address of the user is anonymized, if possible possible. AS-3.12 Implement controls to prevent leakage. Prevent the leakage of user to third party IP address IP addresses applications (e.g., social media)
AS-3.8 Continued Secure Coding and Systems Manage cookies securely if cookies are used: Use the “Secure” attribute with cookies Use the “HttpOnly” attribute with cookies Use the “Domain” attribute with cookies Use the “Path” attribute with cookies Use non-persistent attributes (e.g., “Expires”, with cookies Avoid using the same cookie names for different paths or domain scopes inside the same application AS-3.9 Implement controls to prevent SQL injection. Use prepared statements Use stored procedures Escape all user-supplied input Minimize the privileges assigned to every database account in the environment Validate using whitelisting AS-3.10 Implement controls to prevent unvalidated URL redirects and forwards. Avoid using redirects and forwards Do not allow the user to input the URL if redirects must be used Ensure the supplied URL is valid if user input cannot be avoided Sanitize input using whitelisting if URL input must be allowed AS-3.11 Implement controls to prevent connections from anonymity networks (e.g., Tor, Freenet, Netshade), if possible. Refuse all connections to any part of the application, if the IP address of the user is anonymized, if possible AS-3.12 Implement controls to prevent IP address leakage. Prevent the leakage of user IP addresses to third party applications (e.g., social media)
MPAA-Best-Practices-App-and-Cloud_V1-0-20150507-RELEASE-CANDIDATE-6.docx