Skip to content
Printer-friendly version

Web Application Security Standards


Visit the CDE Web Standards to determine if these standards apply to a specific Web product that is being developed and to determine which other standards might apply.

Application-level Security

  1. Web applications will be secured from "SQL Injection Attacks" where the attacker enters SQL commands into Web form input fields or URL querystrings to try to manipulate the SQL statement being sent to and from the database. The following methods to avoid SQL injection attacks should be used:
    • Use of parameterized queries or stored procedures to access a database as opposed to using string concatenation
    • Limit the amount of characters in Web form input fields and URL querystrings to a proper amount
    • Validate text input and URL querystrings for improper characters (e.g. apostrophe, dash)
    • Do not display errors to the user that contain information about the database or actual source code
  2. ASP.Net Web applications must be secured from "Cross Site Scripting" (XSS) attacks. To accomplish this, developers must ensure that the ASP.Net "validateRequest" Page directive is set to True (the default setting) so that users of the application are prevented from entering HTML or JavaScript code into Web forms. Request Validation - Preventing Script Attacks (Outside Source) is a white paper that provides excellent information on this issue.

Data Transmission Security

When confidential or sensitive data is passed between the end-user and the Web server, the HTTPS (SSL over HTTP) protocol will be used. SSL provides server authentication, data encryption ("over the wire"), and data transmission integrity. The SSL certificate used on the Web server will need to be "trusted" by the Web browsers listed on the CDE’s Minimum Web Browser Requirement Web page.

Database Security

  1. Web applications should use minimum privileges to access database objects (i.e. tables, views, stored procedures). For example, if the Web application needs read-only access to a specific database table, the database permissions should be set accordingly as opposed to giving the Web application "admin or owner" rights to the entire database.
  2. Individual database fields storing confidential or sensitive data (e.g. passwords, social security number) must be stored using encryption techniques.

Password Requirements

Passwords whether created by application developers, administrators, or users must meet or be required through validation to meet all of the following parameters. Passwords must:

Questions:   Web Services Office | tsdweb@cde.ca.gov
Download Free Readers