There's always the www security book by Lincoln Stein, and the
W3 Security FAQ. But the book is a bit dated, as he expected, and
the FAQ is missing out on several issues.
I did an Amazon check, and there only appears to be one book specially
written for ecommerce security; unfortunately, it had no reviews.
I can tell you that you need to consider:
a) how you deal with incorrect user logins... the specific messages
that you give or don't give can help hackers harvest your accounts.
b) at what point you will lock a user's account and require them to call
a service representative.
c) variable names that are passed around, especially as they relate to
authentication. if you call something "token", people are going to
know to exploit it. it's a security by obfuscation thing, but if you
give obvious names to things, you make it that much easier for someone
malicious to get into your inner workings.
d) make sure that your session id's, tokens, etc. are truly random, and
not just pseudo random. there are quite a few packages out there
that just hash the user id with the date, and call it good. it's only
one small step to break that. i don't know how cf's stuff is generated,
though, perhaps Papa Dave does.
e) make sure that you're not doing anything obvious like having variables
that are easy to exploit. the coffee valley stuff starts off passing
dollar amounts in forms, and those form variables are very easy to
rewrite.
f) review all the variables you get from the user to make sure there's
no 'tainting'. for instance, it is possible to embed some pretty
nasty stuff in a variable that gets passed to a query. you can also
pass some delightful javascript, given the right circumstances.
g) you might also think about removing or at least reviewing any comments
in your templates, before you make your site available to the world.
it's a small thing, but then good security is made up of the details.
h) make sure that you verify all variables before performing any actions
with any of them. there are sites out there that, in the same template,
will perform an action based on data that's only half verified, and
verify
the rest of the information later.
That's by no means a comprehensive list; there's lots of stuff out there,
but
that's a good kick in the pants. There are some software products out there
that will actually test an e-comm app for potential vulnerabilities, but I
can't
remember their names off the top of my head (I might be persuaded to look
them
up, though.)
Good luck and happy securing!
- Randy Smith
[EMAIL PROTECTED]
-----Original Message-----
Date: Tue, 16 Jan 2001 10:17:58 +0700
From: "Phim" <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
Subject: Security Programming in Ecommerce
Message-ID:
<[EMAIL PROTECTED]>
Hi Everyone : )
Would you please give me suggestion ?
How can i find the good book or any feature (or any website) talk about
Security Programming in Ecommerce (develop with cold fusion would be great
: ) )
Best regards,
Phim.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Structure your ColdFusion code with Fusebox. Get the official book at
http://www.fusionauthority.com/bkinfo.cfm
Archives: http://www.mail-archive.com/[email protected]/
Unsubscribe: http://www.houseoffusion.com/index.cfm?sidebar=lists
