How do you ensure user input and feedback are secure?

To secure user input and feedback one can do the following:- 1) Use HTTPS for encrypted communication. 2) Implement stringent input validation on both the client and server side. 3) Regularly sanitize and validate user inputs to eliminate potential threats, especially in user-generated content. 4) Safeguard file uploads by validating file types and sizes, storing them securely, and avoiding direct execution. 5) Mitigate CSRF risks with anti-CSRF tokens and conduct routine security audits to identify and address vulnerabilities.

Along with the above mentioned points, it’s always better to sanitize the input value to secure the application. We can get rid of any harm that can be done by code injections through input.

An example of server side validation could be have middleware to check for validity before reaching the main logic. Basically this will discard any invalid data before even reaching the business logic or DB interaction part.

Validation through JavaScript is only one side of the story. You should always validate user input server-side. Both on the application-level and on the subsequent database queries that are sent afterwards. Never trust user input.

Validating input by using HTML5 attributes is good for the user experience, but it doesn't do anything for security since a user can really easily bypass your front end and send you anything they want. You need to validate your input on the backend and make no assumptions about it being correct. If you are expecting a number from 1-10, then make sure that input is a number between 1-10 and exists unless it's optional.

Correct, but this should also be done on the backend. Nothing on the frontend can be considered secure as it can be easily avoided (like using an API directly)

client side inputs should be validate in backend also. specially in SQL string. Use parameterized query in backend to use client side value in SQL query

Sometimes you specifically want to allow users to submit HTML, for example when letting users add content using a rich text/WYSIWYG editor. In these cases functions like `htmlspecialchars` are not very helpful, but it is still important to do some sanitisation. You usually would want to create some rules on what HTML elements you do allow (for example to blacklist `<script>` or `<style>`), and which attributes are allowed for each HTML tag. These rules would be enforced by your back-end, preferably through a popular library, rather than writing your own code for it. HTML parsing and sanitising is complicated!

I recommend encoding it into a binary format like base64 before sending it server side. You especially shouldn’t be storing sensitive info in plain text format (hashing passwords for example)

First before sanitizing input, make sure it needs to be sanitized. Otherwise it could be risky. You may loose data if you don't know user's behavior. Better coach the users before the input option.

https is secure but do not relay on it only. AI bots and let's say some other software could be more smarter then you think.

While HTTPS lays the foundational security for data transmission, it's crucial to remember that security is a multi-layered approach. In other words, don't rely solely on HTTPS, and consider various ways that your systems could be compromised, both from your users (e.g., doing input validation) and external actors (e.g., cross-domain attacks). When it comes to the HTML5 crypto APIs (or other crypto APIs), you probably shouldn't be using them unless you are implementing a protocol or have specific use-cases, such as end-to-end encryption. The reason to avoid them is that they provide low-level primitives that require expert knowledge to use correctly. Instead, first see if there's an existing and vetted library covering your use case.

Always sanitize your inputs from users on the backend (server). You can use libraries such as DOMPurify for this purpose, to help prevent attacks such as XSS (cross-site scripting) attacks. Mozilla's bleach sanitizes HTML in Python, a fantastic addition to helping secure your applications.

XSS attacks are like a wake-up call: user input can't be taken at face value. Would you blindly trust every stranger you meet? Probably not. So, why do that online? That's why you need a solid defence and should always validate inputs and implement defence-in-depth strategies. Tools like CSP, when correctly deployed, can mitigate or limit the impact of any XSS that managed to slip through the cracks of the previous strategies. In a similar vein, avoid JSONP in favour of more modern alternatives like JSON.parse (with CORS as appropriate).

To make XSS attacks less likely - use modern frameworks. Always keep your project dependencies up to date. Always validate user input data before you display it in your application, code symbols such as greater than, ampersand, quotes and so on into HTML entities. To prevent XSS attacks in your projects, read articles that explain and report on newly discovered and successful XSS attacks. Taken together, all of the above steps will reduce your chances of being a target for attackers.

Use open-source, widely supported libraries to help prevent XSS attacks. DOMPurify in JavaScript and bleach in Python are great examples.

CORS is tricky to get right, but it can be a great steppingstone to protect your users. In addition to CORS, validate request headers (e.g., Referer, Origin, Sec-*) to ensure that requests come from where they should (not all cross-origin requests use CORS, for example, form submissions). Note that CORS or headers do not protect you against malicious users and are not a replacement for input validation, sanitisation or permissions, but rather protect against external domains making requests to your site, possibly without your users' knowledge.

Build security tests into your CI/CD pipelines to help streamline your web-readiness. Simple things like destructuring objects and arrays from user input in ES6 JavaScript can lead to very serious security vulnerabilities. Leverage your tools to the fullest to help prevent these.

We can also do sonar lint locally to avoid few security issues. VS code has a good number of extensions to help write the code better.

You can also test for security issues using static and dynamic analysis tools, as well as include and maintain tests that verify security-sensitive functions. One useful technique in the context of user input is fuzzing, i.e., automatically-generated random data.

Yeah, security testing shall be a part of any regression testing and it is always a good idea to maintain a reasonable amount of automated tests to ensure security.

Including a recaptcha system helps to prevent automated bots from submitting malicious data or spamming your application. #security

Ensuring security doesn't mean sacrificing a friendly user experience (UX). Here's how to strike the balance: Immediate Feedback: If something's amiss, tell users straight away, with friendly pointers on how to correct it, the sooner they can fix it, the more pleasant it's going to be(and less failing payload calls for you!) Smart Inputs: Reduce errors with intuitive tools. For example, for date fields, a date-picker is more user-friendly than a text box. Maximize HTML5: Leverage features like placeholders to guide users on input format and expectations. Prioritize Accessibility with ARIA: Everyone should enjoy a seamless UX. ARIA helps users with disabilities navigate and fill forms easily.

Authentication and Authorization Ability to identify user and to control access privileges are key to security of user input and data integrity. Authentication requires that users identify themselves by proving their identity. Authorization, on the other hand, requires that access rights of users are enforced; restricting users to authorized resources or privileged information accorded.

Remember that most hacker attacks come from your internal networks - administrative logins can be compromised, as can your entire infrastructure. Do not hesitate to add additional content input checks and post-processing for your internal team of content managers and administrators, even if they are trusted. As software developers, we are responsible for the behaviour of the entire system.