Web application security checklist: ten checks

Ten checks to do before ordering a test. They do not replace the test: they help you not start from zero.

Access between users

A user cannot see or change another user's data by changing an identifier.

Sessions expire and close on logout.

Reset does not reveal whether an account exists, and the link expires.

Text fields do not run code and do not reveal internal errors.

Libraries are up to date and the inventory is known.

No keys or passwords in the code or in published packages.

Policies for content, transport and framing are set.

Failed logins and sensitive changes are recorded.

Prices, quantities and order states cannot be changed from the browser.