Skip to content

Security Features

Jump to bottom
Philippe Marschall edited this page Jul 15, 2015 · 13 revisions

Unlike some low level frameworks Seaside offers built in protection against many common web application vulnerabilities.

Attacks

This is how Seaside protects you against common attacks against your web application.

Session Fixation

Further information:

Not possible because client supplied session ids are ignored when no matching session is found. Review the implementors of #noHandlerFoundForKey:in:context:.

Cross-site Scripting (XSS)

The Seaside templating engine—the render canvas—escapes all output by default. It therefore adopts a safe by default policy. Special effort has to be taken to render values without escaping. Such places can easily be found and audited by looking at all the senders of #html:.

Further information:

Cross-Site Request Forgery (CSRF)

Further information:

Response Splitting

HTTP response splitting is an attack that allows an attacker to control response headers and the body by injecting a header with a CR or LF value. Seaside does not allow CR or LF values in headers which are also not allowed by HTTP.

Further information:

Malicious File Execution

Further information:

Features

In addition to the protections against the attacks above Seaside offers the following security related features.

Capabilities

Strict Transport Security (STS)

DoS

  • hash collisions
  • request headers (body size)

Arbitrary Code Execution

Boolean readFrom:

Further Information

Changelogs

Development

Documentation

Sprints

Clone this wiki locally