保障用户安全：让您的 Ibexa 应用程序坚不可摧.pdf

1、Keeping your users secureMaking your Ibexa application bulletproofHello,Im LucasIve been at Platform.shfor almost 7 years!I used to do technical pre-sales,but was ops before thatMy secret love is finding weird workarounds that are technically correct(the best kind of correct)He/Him/HisSenior manager

2、,OMS teamTable of contentsFramework(s)Your code and customizationsInfrastructureSecurity and youFramework(s)Updates,updates,.Update allthe things!In your OSpackage managerWhats your PHP versionComposerNode?Some tools are there to help you-Topgrade(always test before)can upgrade everything-Snyk,Aikad

3、o can scan your dependencies-composer outdated fits right in your workflowProtect endpointsDont hide,strengthen“My/admin is/admin7”Protect from path traversalRate limit endpointsConsider a WAFCachingtoo much?Too little is badBut too much is worseIbexas VCL can take care of the heavy liftingVidar has

4、 a talk about it right after mineYour codeand customizationsTokensYoure not using defaults,right?ThisTokenIsNotSoSecretChangeItWhere should you store them?Test your codeMany tools can helpStatic analysis toolsAutomated scannersPentests,bug bountiesBlackfire rocksEncourage disclosureResponsible hacke

5、rs/security.txtRewards?Escaping contentNever trust user input);DROP TABLE students;-CORS likes you,actuallyXSSUser uploadsSymfony Validator and escaperInfrastructureFirewallingMinimum exposure policyStrong passwords everywhere elseEncryption for everything internet-facingAutomated blocking(bad IPs,f

6、ail2ban)The internet of(bad)thingsUse HTTPSNot any HTTPS thoughConsider HSTSTLS 1.3Key strengthTest your certificates with SSL Labs or testssl.sh locallyScriptsYour app is a scriptYour pictures arent!Check for separationProtect uploadsStrive for read-only where you canBackupsTake