Security checklist for apps #

This checklist is for app developers and the administrator of the installation the app talks to. Go through it before the first release and again whenever credentials, roles or endpoints change.

Contents #

1. Credentials
2. Accounts and roles
3. Transport
4. In the app
5. Writes
6. Browser apps
7. Monitoring

Credentials #

• To do: No OAuth client secret, personal API key or expservices token is in the app's code, resources or configuration (Choosing a credential).
• To do: The OAuth code exchange and refresh run on a back end that holds the client secret (A back end for your app).
• To do: The app correlates the OAuth callback itself, since state is not returned (OAuth2 authorization code flow).
• To do: response_type=token is not used.
• To do: Keys used by back ends and tools have the smallest scopes and a lifetime, and a rotation date is in the calendar.
• To do: expk_ and expt_ are in the secret scanner of every repository.

Accounts and roles #

• To do: Each app has its own integration user; none uses the administrator or a person's account.
• To do: content/read is limited to the sections or subtrees the app shows.
• To do: Write policies are limited to one folder and the classes the app creates.
• To do: No setup, class or user policies for app users.
• To do: oauth/authorize only for the roles of people who use the app (Permissions for app users).

Transport #

• To do: Every request uses HTTPS; consider rest.ini [Authentication] RequireHTTPS=enabled on the server.
• To do: The Authorization header reaches PHP on every server and through every proxy (The Authorization header and proxies).
• To do: Proxies and CDNs do not cache answers to requests with Authorization.
• To do: No credential is ever sent in a URL.

In the app #

• To do: Tokens are in Keychain or Keystore, not in preferences or files (Storing secrets on devices).
• To do: HTTP logging strips Authorization and X-Exp-Token, in every build that leaves the developer's machine.
• To do: Sign-out deletes tokens and revokes expservices tokens.
• To do: Rendered HTML (renderedOutput) is shown in a web view without scripts it does not need, and external links open in the system browser (Rendered XHTML output).

Writes #

• To do: Removes ask the user to confirm (Creating and removing content).
• To do: Retries of creates cannot duplicate content (remote ids, 409).
• To do: Any upload endpoint built for the app checks size, type by content, and permissions (Files and uploads).

Browser apps #

• To do: Any CORS headers added at the web server name explicit origins and cover only the API paths (Web apps, CORS and CSP).
• To do: The Content Security Policy allows the app's connections and nothing more.

Monitoring #

• To do: Someone reads the access channel of the audit after each release: access.apikey.use.failed, access.expservices.token.failed (Auditing app activity).
• To do: There is a plan for a leaked credential: revoke, rotate, check the audit.

Related pages #

• Security for applications
• Security hardening
• Personal API keys: security notes
• Free documentation: this page is free to copy, translate and improve under the GNU FDL 1.3.