Web Standards - idmontie's Portfolio

/*@jsxRuntime automatic @jsxImportSource react*/
const {Fragment: _Fragment, jsx: _jsx, jsxs: _jsxs} = arguments[0];
function _createMdxContent(props) {
  const _components = Object.assign({
    p: "p",
    h2: "h2",
    a: "a",
    strong: "strong",
    ul: "ul",
    li: "li",
    pre: "pre",
    code: "code",
    blockquote: "blockquote"
  }, props.components);
  return _jsxs(_Fragment, {
    children: [_jsx(_components.p, {
      children: "This post was originally on a blog I started for creating web applications. This post goes into security for web applications."
    }), "\n", _jsx(_components.h2, {
      children: "Prevent Against SQL Injection"
    }), "\n", _jsxs(_components.p, {
      children: ["Read about ", _jsx(_components.a, {
        href: "http://en.wikipedia.org/wiki/SQL_injection",
        children: "SQL injection"
      }), " and learn how to prevent it for the langauge and database you are using."]
    }), "\n", _jsx(_components.h2, {
      children: "All User Input is Filtered"
    }), "\n", _jsx(_components.p, {
      children: "Never trust user input.  This includes cookies and hidden form field values."
    }), "\n", _jsx(_components.h2, {
      children: "Read the Open Web Application Security Project"
    }), "\n", _jsxs(_components.p, {
      children: ["Read ", _jsx(_components.a, {
        href: "https://www.owasp.org/index.php/Category:OWASP_Guide_Project",
        children: "the Open Web Application Security Project"
      }), "."]
    }), "\n", _jsx(_components.h2, {
      children: "All Passwords are Hashed with a Salt"
    }), "\n", _jsxs(_components.p, {
      children: ["Hash all passwords using a ", _jsx(_components.a, {
        href: "http://security.stackexchange.com/q/21263/396",
        children: "salt"
      }), " and all salts are different to prevent against ", _jsx(_components.a, {
        href: "http://en.wikipedia.org/wiki/Rainbow_table",
        children: "rainbow attacks"
      }), "."]
    }), "\n", _jsxs(_components.p, {
      children: ["The hashing algorithm should be bcrypt or scrypt for storing passwords.  Look into ", _jsx(_components.a, {
        href: "http://codahale.com/how-to-safely-store-a-password/",
        children: "How To Safely Sroe a Password"
      }), "."]
    }), "\n", _jsxs(_components.p, {
      children: ["Do ", _jsx(_components.strong, {
        children: "not"
      }), " use MD5 or any SHA algorithm.  SHA algorithms are meant to be fast, which should not be used for trying to securely store passwords."]
    }), "\n", _jsx(_components.h2, {
      children: "Use a Standard Authentication System"
    }), "\n", _jsx(_components.p, {
      children: "Do not role your own authentication system."
    }), "\n", _jsx(_components.h2, {
      children: "Process Credit Card Information Correctly"
    }), "\n", _jsxs(_components.p, {
      children: ["Look into the ", _jsx(_components.a, {
        href: "https://www.pcisecuritystandards.org/",
        children: "PCI Security Standards"
      }), " for financial security information."]
    }), "\n", _jsx(_components.h2, {
      children: "Use HTTPS for Sensitive Data"
    }), "\n", _jsxs(_components.p, {
      children: ["Set up your ", _jsx(_components.a, {
        href: "http://www.mozilla.org/projects/security/pki/nss/ssl/draft302.txt",
        children: "SSL"
      }), "/", _jsx(_components.a, {
        href: "http://en.wikipedia.org/wiki/Https",
        children: "HTTPS"
      }), " certs correctly and check it against ", _jsx(_components.a, {
        href: "https://www.ssllabs.com/ssltest/",
        children: "SSL Labs Server Test"
      }), "."]
    }), "\n", _jsx(_components.h2, {
      children: "Prevent Session Hijacking"
    }), "\n", _jsx(_components.p, {
      children: "Built in session systems are usually premade to handle these types of attacks. It is not recommended that you roll your own, but it should have the following features:"
    }), "\n", _jsxs(_components.ul, {
      children: ["\n", _jsx(_components.li, {
        children: "Encrypted data traffic.  The session key in particular should be encrypted, but ideally all traffic should be encrypted by using SSL/TLS."
      }), "\n", _jsx(_components.li, {
        children: "Long random session key.  Attackers should not be able to guess valid session keys."
      }), "\n", _jsxs(_components.li, {
        children: ["Regenerating the session id after a successful login.  Prevents [session fixation](", _jsx(_components.a, {
          href: "http://en.wikipedia.org/wiki/Session_fixation%5D",
          children: "http://en.wikipedia.org/wiki/Session_fixation]"
        }), "."]
      }), "\n", _jsx(_components.li, {
        children: "Change the cookie value with each and every request.  This reduces the window for an attacker to hijack the session."
      }), "\n"]
    }), "\n", _jsx(_components.h2, {
      children: "Prevent Cross Site Scripting (XSS)"
    }), "\n", _jsxs(_components.p, {
      children: ["Unfiltered query parameters that are added to the DOM are an easy way for attackers to use cross site scripting to pull data from your users.  Filter all query parameters; see ", _jsx(_components.a, {
        href: "http://en.wikipedia.org/wiki/Cross-site_scripting",
        children: "Cross-site Scripting"
      }), " for more information on common attacks and prevention methods."]
    }), "\n", _jsx(_components.h2, {
      children: "Prevent Page Embedding"
    }), "\n", _jsx(_components.p, {
      children: "You can prevent page embedding with the following header:"
    }), "\n", _jsx(_components.pre, {
      children: _jsx(_components.code, {
        children: "X-Frame-Options: DENY\n"
      })
    }), "\n", _jsx(_components.p, {
      children: "This will cause browsers to refuse requests for framing in that page."
    }), "\n", _jsxs(_components.p, {
      children: ["You can also prevent page embedding with JavaScript to prevent users from accessing your website in an iframe.  Look into this ", _jsx(_components.a, {
        href: "http://stackoverflow.com/questions/7776281/javascript-jquery-how-to-detect-if-a-page-is-embedded-by-others",
        children: "StackOverflow solution"
      }), "."]
    }), "\n", _jsx(_components.h2, {
      children: "Prevent Cross Site Request Forgeries"
    }), "\n", _jsx(_components.p, {
      children: "Cross site request forgeries are attacks by a malicious user whereby they craft a link to a site which a user is know to have been authenticated.  For example, say your site is a bank website; the malicious user may craft a URL for you site that when a user clicks on it, deposits money into the attacker's account.  The attacker then sends the link to users who may have been logged into your bank website."
    }), "\n", _jsxs(_components.p, {
      children: ["According to ", _jsx(_components.a, {
        href: "http://en.wikipedia.org/wiki/Cross-site_request_forgery",
        children: "Wikipedia"
      }), ":"]
    }), "\n", _jsxs(_components.blockquote, {
      children: ["\n", _jsx(_components.p, {
        children: "At risk are web applications that perform actions based on input from trusted and authenticated users without requiring the user to authorize the specific action. A user who is authenticated by a cookie saved in the user's web browser could unknowingly send an HTTP request to a site that trusts the user and thereby causes an unwanted action."
      }), "\n"]
    }), "\n", _jsx(_components.h2, {
      children: "Prevent Click Jacking"
    }), "\n", _jsxs(_components.p, {
      children: ["Similar to ", _jsx(_components.a, {
        href: "#prevent-page-embedding",
        children: "Page Embedding"
      }), ", click jacking works by:"]
    }), "\n", _jsxs(_components.blockquote, {
      children: ["\n", _jsx(_components.p, {
        children: "A user might receive an email with a link to a video about a news item, but another valid page, say a product page on Amazon.com, can be \"hidden\" on top or underneath the \"PLAY\" button of the news video. The user tries to \"play\" the video but actually \"buys\" the product from Amazon."
      }), "\n"]
    }), "\n", _jsx(_components.p, {
      children: "Other known exploits include:"
    }), "\n", _jsxs(_components.ul, {
      children: ["\n", _jsx(_components.li, {
        children: "Tricking users into enabling their webcam and microphone through Flash"
      }), "\n", _jsx(_components.li, {
        children: "Tricking users into making their social networking profile information public"
      }), "\n", _jsx(_components.li, {
        children: "Making users follow someone on Twitter[8]"
      }), "\n", _jsx(_components.li, {
        children: "Sharing links on Facebook"
      }), "\n"]
    }), "\n", _jsxs(_components.p, {
      children: ["See ", _jsx(_components.a, {
        href: "http://en.wikipedia.org/wiki/Clickjacking",
        children: "Wikipedia"
      }), " for more information."]
    }), "\n", _jsx(_components.h2, {
      children: "Verify That Server Software is Up to Date"
    }), "\n", _jsx(_components.p, {
      children: "Make sure that the software on your system is up to date with the latest patches."
    }), "\n", _jsx(_components.h2, {
      children: "Verify That Packages, Modules, Plugins, etc are Up to Date"
    }), "\n", _jsx(_components.p, {
      children: "Make sure that the latest software used by your projest is up to date with the latest patches."
    }), "\n", _jsx(_components.h2, {
      children: "Verify That Your Database is Secured"
    }), "\n", _jsx(_components.p, {
      children: "Make sure that connections to the database are at least password protected.  Verify that only the least amount of permissions are being used."
    }), "\n", _jsx(_components.p, {
      children: "Make sure that confidential information is encrypted or hashed."
    }), "\n", _jsx(_components.h2, {
      children: "Attempt to Make Your App Run As Non-Root"
    }), "\n", _jsxs(_components.p, {
      children: ["Apply ", _jsx(_components.a, {
        href: "https://en.wikipedia.org/wiki/Principle_of_least_privilege",
        children: "the principle of least privilege"
      }), " and try to have your app run as non-root as often as possible."]
    }), "\n", _jsx(_components.h2, {
      children: "Use the Content-Security-Policy Header"
    }), "\n", _jsx(_components.p, {
      children: "Specify the following header to make the browser only run certain content depending on its origin:"
    }), "\n", _jsx(_components.p, {
      children: _jsx(_components.strong, {
        children: "example"
      })
    }), "\n", _jsx(_components.pre, {
      children: _jsx(_components.code, {
        children: "Content-Security-Policy: script-src 'self' https://apis.google.com\n"
      })
    }), "\n", _jsx(_components.p, {
      children: "You can also specify the following type of content:"
    }), "\n", _jsxs(_components.ul, {
      children: ["\n", _jsx(_components.li, {
        children: "script-src (JavaScript)"
      }), "\n", _jsx(_components.li, {
        children: "connect-src (XMLHttpRequest, WebSockets, and EventSource)"
      }), "\n", _jsx(_components.li, {
        children: "font-src (Fonts)"
      }), "\n", _jsx(_components.li, {
        children: "frame-src (Frame Urls)"
      }), "\n", _jsx(_components.li, {
        children: "img-src (Images)"
      }), "\n", _jsx(_components.li, {
        children: "media-src (Audio and Videos)"
      }), "\n", _jsx(_components.li, {
        children: "object-src (Flash)"
      }), "\n", _jsx(_components.li, {
        children: "style-src (CSS)"
      }), "\n"]
    }), "\n", _jsx(_components.h2, {
      children: "Do Not Allow Mime Sniffing with User Uploaded Content"
    }), "\n", _jsx(_components.p, {
      children: "You can tell browsers to not try to guess Mime Types of files with the following header:"
    }), "\n", _jsx(_components.pre, {
      children: _jsx(_components.code, {
        children: "X-CONTENT-TYPE-OPTIONS: nosniff\n"
      })
    }), "\n", _jsx(_components.p, {
      children: "For example, say a user uploads an HTML file. You intend to serve it to users as a text file, but the browser will attempt to serve it as an HTML page.  You can tell the browser that you know what you are doing and that the Mime Type you are providing is indeed correct by using the above header."
    }), "\n", _jsx(_components.h2, {
      children: "Force HTTPS Traffic"
    }), "\n", _jsx(_components.p, {
      children: "You can force HTTPS Traffic with the following header:"
    }), "\n", _jsx(_components.pre, {
      children: _jsx(_components.code, {
        children: "Scrict-Transport-Security: max-age=31536000; includeSubDomains\n"
      })
    }), "\n", _jsxs(_components.p, {
      children: ["This will force ", _jsx(_components.code, {
        children: "https://website.com"
      }), " even when typing in ", _jsx(_components.code, {
        children: "http://website.com"
      })]
    })]
  });
}
function MDXContent(props = {}) {
  const {wrapper: MDXLayout} = props.components || ({});
  return MDXLayout ? _jsx(MDXLayout, Object.assign({}, props, {
    children: _jsx(_createMdxContent, props)
  })) : _createMdxContent(props);
}
return {
  default: MDXContent
};


<p>This post was originally on a blog I started for creating web applications. This post goes into security for web applications.</p>
<h2>Prevent Against SQL Injection</h2>
<p>Read about <a href="http://en.wikipedia.org/wiki/SQL_injection">SQL injection</a> and learn how to prevent it for the langauge and database you are using.</p>
<h2>All User Input is Filtered</h2>
<p>Never trust user input.  This includes cookies and hidden form field values.</p>
<h2>Read the Open Web Application Security Project</h2>
<p>Read <a href="https://www.owasp.org/index.php/Category:OWASP_Guide_Project">the Open Web Application Security Project</a>.</p>
<h2>All Passwords are Hashed with a Salt</h2>
<p>Hash all passwords using a <a href="http://security.stackexchange.com/q/21263/396">salt</a> and all salts are different to prevent against <a href="http://en.wikipedia.org/wiki/Rainbow_table">rainbow attacks</a>.</p>
<p>The hashing algorithm should be bcrypt or scrypt for storing passwords.  Look into <a href="http://codahale.com/how-to-safely-store-a-password/">How To Safely Sroe a Password</a>.</p>
<p>Do <strong>not</strong> use MD5 or any SHA algorithm.  SHA algorithms are meant to be fast, which should not be used for trying to securely store passwords.</p>
<h2>Use a Standard Authentication System</h2>
<p>Do not role your own authentication system.</p>
<h2>Process Credit Card Information Correctly</h2>
<p>Look into the <a href="https://www.pcisecuritystandards.org/">PCI Security Standards</a> for financial security information.</p>
<h2>Use HTTPS for Sensitive Data</h2>
<p>Set up your <a href="http://www.mozilla.org/projects/security/pki/nss/ssl/draft302.txt">SSL</a>/<a href="http://en.wikipedia.org/wiki/Https">HTTPS</a> certs correctly and check it against <a href="https://www.ssllabs.com/ssltest/">SSL Labs Server Test</a>.</p>
<h2>Prevent Session Hijacking</h2>
<p>Built in session systems are usually premade to handle these types of attacks. It is not recommended that you roll your own, but it should have the following features:</p>
<ul>
<li>Encrypted data traffic.  The session key in particular should be encrypted, but ideally all traffic should be encrypted by using SSL/TLS.</li>
<li>Long random session key.  Attackers should not be able to guess valid session keys.</li>
<li>Regenerating the session id after a successful login.  Prevents [session fixation](<a href="http://en.wikipedia.org/wiki/Session_fixation%5D">http://en.wikipedia.org/wiki/Session_fixation]</a>.</li>
<li>Change the cookie value with each and every request.  This reduces the window for an attacker to hijack the session.</li>
</ul>
<h2>Prevent Cross Site Scripting (XSS)</h2>
<p>Unfiltered query parameters that are added to the DOM are an easy way for attackers to use cross site scripting to pull data from your users.  Filter all query parameters; see <a href="http://en.wikipedia.org/wiki/Cross-site_scripting">Cross-site Scripting</a> for more information on common attacks and prevention methods.</p>
<h2>Prevent Page Embedding</h2>
<p>You can prevent page embedding with the following header:</p>
<div class="overflow-auto rounded bg-gray-200 p-4 font-mono text-sm dark:bg-gray-800 dark:text-gray-100"><pre><code>X-Frame-Options: DENY
</code></pre></div>
<p>This will cause browsers to refuse requests for framing in that page.</p>
<p>You can also prevent page embedding with JavaScript to prevent users from accessing your website in an iframe.  Look into this <a href="http://stackoverflow.com/questions/7776281/javascript-jquery-how-to-detect-if-a-page-is-embedded-by-others">StackOverflow solution</a>.</p>
<h2>Prevent Cross Site Request Forgeries</h2>
<p>Cross site request forgeries are attacks by a malicious user whereby they craft a link to a site which a user is know to have been authenticated.  For example, say your site is a bank website; the malicious user may craft a URL for you site that when a user clicks on it, deposits money into the attacker&#x27;s account.  The attacker then sends the link to users who may have been logged into your bank website.</p>
<p>According to <a href="http://en.wikipedia.org/wiki/Cross-site_request_forgery">Wikipedia</a>:</p>
<blockquote class="border-l-4 border-gray-300 pl-4">
<p>At risk are web applications that perform actions based on input from trusted and authenticated users without requiring the user to authorize the specific action. A user who is authenticated by a cookie saved in the user&#x27;s web browser could unknowingly send an HTTP request to a site that trusts the user and thereby causes an unwanted action.</p>
</blockquote>
<h2>Prevent Click Jacking</h2>
<p>Similar to <a href="#prevent-page-embedding">Page Embedding</a>, click jacking works by:</p>
<blockquote class="border-l-4 border-gray-300 pl-4">
<p>A user might receive an email with a link to a video about a news item, but another valid page, say a product page on Amazon.com, can be &quot;hidden&quot; on top or underneath the &quot;PLAY&quot; button of the news video. The user tries to &quot;play&quot; the video but actually &quot;buys&quot; the product from Amazon.</p>
</blockquote>
<p>Other known exploits include:</p>
<ul>
<li>Tricking users into enabling their webcam and microphone through Flash</li>
<li>Tricking users into making their social networking profile information public</li>
<li>Making users follow someone on Twitter[8]</li>
<li>Sharing links on Facebook</li>
</ul>
<p>See <a href="http://en.wikipedia.org/wiki/Clickjacking">Wikipedia</a> for more information.</p>
<h2>Verify That Server Software is Up to Date</h2>
<p>Make sure that the software on your system is up to date with the latest patches.</p>
<h2>Verify That Packages, Modules, Plugins, etc are Up to Date</h2>
<p>Make sure that the latest software used by your projest is up to date with the latest patches.</p>
<h2>Verify That Your Database is Secured</h2>
<p>Make sure that connections to the database are at least password protected.  Verify that only the least amount of permissions are being used.</p>
<p>Make sure that confidential information is encrypted or hashed.</p>
<h2>Attempt to Make Your App Run As Non-Root</h2>
<p>Apply <a href="https://en.wikipedia.org/wiki/Principle_of_least_privilege">the principle of least privilege</a> and try to have your app run as non-root as often as possible.</p>
<h2>Use the Content-Security-Policy Header</h2>
<p>Specify the following header to make the browser only run certain content depending on its origin:</p>
<p><strong>example</strong></p>
<div class="overflow-auto rounded bg-gray-200 p-4 font-mono text-sm dark:bg-gray-800 dark:text-gray-100"><pre><code>Content-Security-Policy: script-src &#x27;self&#x27; https://apis.google.com
</code></pre></div>
<p>You can also specify the following type of content:</p>
<ul>
<li>script-src (JavaScript)</li>
<li>connect-src (XMLHttpRequest, WebSockets, and EventSource)</li>
<li>font-src (Fonts)</li>
<li>frame-src (Frame Urls)</li>
<li>img-src (Images)</li>
<li>media-src (Audio and Videos)</li>
<li>object-src (Flash)</li>
<li>style-src (CSS)</li>
</ul>
<h2>Do Not Allow Mime Sniffing with User Uploaded Content</h2>
<p>You can tell browsers to not try to guess Mime Types of files with the following header:</p>
<div class="overflow-auto rounded bg-gray-200 p-4 font-mono text-sm dark:bg-gray-800 dark:text-gray-100"><pre><code>X-CONTENT-TYPE-OPTIONS: nosniff
</code></pre></div>
<p>For example, say a user uploads an HTML file. You intend to serve it to users as a text file, but the browser will attempt to serve it as an HTML page.  You can tell the browser that you know what you are doing and that the Mime Type you are providing is indeed correct by using the above header.</p>
<h2>Force HTTPS Traffic</h2>
<p>You can force HTTPS Traffic with the following header:</p>
<div class="overflow-auto rounded bg-gray-200 p-4 font-mono text-sm dark:bg-gray-800 dark:text-gray-100"><pre><code>Scrict-Transport-Security: max-age=31536000; includeSubDomains
</code></pre></div>
<p>This will force <code>https://website.com</code> even when typing in <code>http://website.com</code></p>


This post was originally on a blog I started for creating web applications. This post goes into security for web applications.

## Prevent Against SQL Injection

Read about [SQL injection](http://en.wikipedia.org/wiki/SQL_injection) and learn how to prevent it for the langauge and database you are using.

## All User Input is Filtered

Never trust user input.  This includes cookies and hidden form field values.

## Read the Open Web Application Security Project

Read [the Open Web Application Security Project](https://www.owasp.org/index.php/Category:OWASP_Guide_Project).

## All Passwords are Hashed with a Salt

Hash all passwords using a [salt](http://security.stackexchange.com/q/21263/396) and all salts are different to prevent against [rainbow attacks](http://en.wikipedia.org/wiki/Rainbow_table).

The hashing algorithm should be bcrypt or scrypt for storing passwords.  Look into [How To Safely Sroe a Password](http://codahale.com/how-to-safely-store-a-password/).

Do **not** use MD5 or any SHA algorithm.  SHA algorithms are meant to be fast, which should not be used for trying to securely store passwords.

## Use a Standard Authentication System

Do not role your own authentication system.

## Process Credit Card Information Correctly

Look into the [PCI Security Standards](https://www.pcisecuritystandards.org/) for financial security information.

## Use HTTPS for Sensitive Data

Set up your [SSL](http://www.mozilla.org/projects/security/pki/nss/ssl/draft302.txt)/[HTTPS](http://en.wikipedia.org/wiki/Https) certs correctly and check it against [SSL Labs Server Test](https://www.ssllabs.com/ssltest/).

## Prevent Session Hijacking

Built in session systems are usually premade to handle these types of attacks. It is not recommended that you roll your own, but it should have the following features:

- Encrypted data traffic.  The session key in particular should be encrypted, but ideally all traffic should be encrypted by using SSL/TLS.
- Long random session key.  Attackers should not be able to guess valid session keys.
- Regenerating the session id after a successful login.  Prevents [session fixation](http://en.wikipedia.org/wiki/Session_fixation].
- Change the cookie value with each and every request.  This reduces the window for an attacker to hijack the session.

## Prevent Cross Site Scripting (XSS)

Unfiltered query parameters that are added to the DOM are an easy way for attackers to use cross site scripting to pull data from your users.  Filter all query parameters; see [Cross-site Scripting](http://en.wikipedia.org/wiki/Cross-site_scripting) for more information on common attacks and prevention methods.

## Prevent Page Embedding

You can prevent page embedding with the following header:

```
X-Frame-Options: DENY
```

This will cause browsers to refuse requests for framing in that page.

You can also prevent page embedding with JavaScript to prevent users from accessing your website in an iframe.  Look into this [StackOverflow solution](http://stackoverflow.com/questions/7776281/javascript-jquery-how-to-detect-if-a-page-is-embedded-by-others).

## Prevent Cross Site Request Forgeries

Cross site request forgeries are attacks by a malicious user whereby they craft a link to a site which a user is know to have been authenticated.  For example, say your site is a bank website; the malicious user may craft a URL for you site that when a user clicks on it, deposits money into the attacker's account.  The attacker then sends the link to users who may have been logged into your bank website.

According to [Wikipedia](http://en.wikipedia.org/wiki/Cross-site_request_forgery):

> At risk are web applications that perform actions based on input from trusted and authenticated users without requiring the user to authorize the specific action. A user who is authenticated by a cookie saved in the user's web browser could unknowingly send an HTTP request to a site that trusts the user and thereby causes an unwanted action.

## Prevent Click Jacking

Similar to [Page Embedding](#prevent-page-embedding), click jacking works by:

> A user might receive an email with a link to a video about a news item, but another valid page, say a product page on Amazon.com, can be "hidden" on top or underneath the "PLAY" button of the news video. The user tries to "play" the video but actually "buys" the product from Amazon.

Other known exploits include:

- Tricking users into enabling their webcam and microphone through Flash
- Tricking users into making their social networking profile information public
- Making users follow someone on Twitter[8]
- Sharing links on Facebook

See [Wikipedia](http://en.wikipedia.org/wiki/Clickjacking) for more information.

## Verify That Server Software is Up to Date

Make sure that the software on your system is up to date with the latest patches.

## Verify That Packages, Modules, Plugins, etc are Up to Date

Make sure that the latest software used by your projest is up to date with the latest patches.

## Verify That Your Database is Secured

Make sure that connections to the database are at least password protected.  Verify that only the least amount of permissions are being used.

Make sure that confidential information is encrypted or hashed.

## Attempt to Make Your App Run As Non-Root

Apply [the principle of least privilege](https://en.wikipedia.org/wiki/Principle_of_least_privilege) and try to have your app run as non-root as often as possible.

## Use the Content-Security-Policy Header

Specify the following header to make the browser only run certain content depending on its origin:

**example**

```
Content-Security-Policy: script-src 'self' https://apis.google.com
```

You can also specify the following type of content:

- script-src (JavaScript)
- connect-src (XMLHttpRequest, WebSockets, and EventSource)
- font-src (Fonts)
- frame-src (Frame Urls)
- img-src (Images)
- media-src (Audio and Videos)
- object-src (Flash)
- style-src (CSS)

## Do Not Allow Mime Sniffing with User Uploaded Content

You can tell browsers to not try to guess Mime Types of files with the following header:

```
X-CONTENT-TYPE-OPTIONS: nosniff
```

For example, say a user uploads an HTML file. You intend to serve it to users as a text file, but the browser will attempt to serve it as an HTML page.  You can tell the browser that you know what you are doing and that the Mime Type you are providing is indeed correct by using the above header.

## Force HTTPS Traffic

You can force HTTPS Traffic with the following header:

```
Scrict-Transport-Security: max-age=31536000; includeSubDomains
```

This will force `https://website.com` even when typing in `http://website.com`


Security

/*@jsxRuntime automatic @jsxImportSource react*/
const {Fragment: _Fragment, jsx: _jsx, jsxs: _jsxs} = arguments[0];
function _createMdxContent(props) {
  const _components = Object.assign({
    p: "p",
    h2: "h2",
    code: "code",
    a: "a",
    blockquote: "blockquote"
  }, props.components);
  return _jsxs(_Fragment, {
    children: [_jsx(_components.p, {
      children: "This post was originally on a blog I started for creating web applications. This post goes into using web standards and best practices."
    }), "\n", _jsx(_components.h2, {
      children: "Check that GET and POST Requests are Used Properly"
    }), "\n", _jsxs(_components.p, {
      children: [_jsx(_components.code, {
        children: "GET"
      }), " request should be for requesting information."]
    }), "\n", _jsxs(_components.p, {
      children: [_jsx(_components.code, {
        children: "POST"
      }), " requests should be for sending information."]
    }), "\n", _jsxs(_components.p, {
      children: ["A ", _jsx(_components.code, {
        children: "GET"
      }), " request should not change the object that is being requests."]
    }), "\n", _jsx(_components.h2, {
      children: "Validate your HTML and CSS"
    }), "\n", _jsxs(_components.p, {
      children: ["Write your ", _jsx(_components.a, {
        href: "http://www.w3.org/TR/xhtml1/",
        children: "XHTML"
      }), " or ", _jsx(_components.a, {
        href: "http://www.w3.org/TR/REC-html40/",
        children: "HTML"
      }), " and ", _jsx(_components.a, {
        href: "http://www.w3.org/TR/CSS2/",
        children: "CSS"
      }), " according to ", _jsx(_components.a, {
        href: "http://www.w3.org/TR/",
        children: "the W3C specifications"
      }), " and make sure they ", _jsx(_components.a, {
        href: "http://validator.w3.org/",
        children: "validate"
      }), "."]
    }), "\n", _jsx(_components.p, {
      children: "Avoid browser quirks modes by doing this."
    }), "\n", _jsx(_components.h2, {
      children: "Use 301 and 302 Redirects Correctly"
    }), "\n", _jsxs(_components.p, {
      children: ["According to ", _jsx(_components.a, {
        href: "http://www.bigoakinc.com/blog/when-to-use-a-301-vs-302-redirect/",
        children: "Bigoak Inc"
      }), ":"]
    }), "\n", _jsxs(_components.blockquote, {
      children: ["\n", _jsx(_components.p, {
        children: "All three major search engines handle 301 redirects the same, that is to say they ignore the original URL and instead index the destination URL."
      }), "\n"]
    }), "\n", _jsxs(_components.blockquote, {
      children: ["\n", _jsx(_components.p, {
        children: "The three major engines handle 302 redirects very differently, and because of this 302s are typically not recommended."
      }), "\n"]
    }), "\n", _jsx(_components.p, {
      children: "Best practice is to use 301 redirects (which are permanent and are usually cached by the browser).  For temporary moves, use 302 redirects."
    }), "\n", _jsx(_components.h2, {
      children: "Force IE to Use Unicode for Parameters"
    }), "\n", _jsxs(_components.p, {
      children: ["If you have ever seen ", _jsx(_components.code, {
        children: "utf8=✓"
      }), " in the parameter listing of a url, it's in order to ", _jsx(_components.a, {
        href: "http://stackoverflow.com/questions/3222013/what-is-the-snowman-param-in-ruby-on-rails-3-forms-for/3348524#3348524",
        children: "force Internet Explorer (5, 6, 7 and 8) to encode its parameters as unicode"
      }), "."]
    })]
  });
}
function MDXContent(props = {}) {
  const {wrapper: MDXLayout} = props.components || ({});
  return MDXLayout ? _jsx(MDXLayout, Object.assign({}, props, {
    children: _jsx(_createMdxContent, props)
  })) : _createMdxContent(props);
}
return {
  default: MDXContent
};


<p>This post was originally on a blog I started for creating web applications. This post goes into using web standards and best practices.</p>
<h2>Check that GET and POST Requests are Used Properly</h2>
<p><code>GET</code> request should be for requesting information.</p>
<p><code>POST</code> requests should be for sending information.</p>
<p>A <code>GET</code> request should not change the object that is being requests.</p>
<h2>Validate your HTML and CSS</h2>
<p>Write your <a href="http://www.w3.org/TR/xhtml1/">XHTML</a> or <a href="http://www.w3.org/TR/REC-html40/">HTML</a> and <a href="http://www.w3.org/TR/CSS2/">CSS</a> according to <a href="http://www.w3.org/TR/">the W3C specifications</a> and make sure they <a href="http://validator.w3.org/">validate</a>.</p>
<p>Avoid browser quirks modes by doing this.</p>
<h2>Use 301 and 302 Redirects Correctly</h2>
<p>According to <a href="http://www.bigoakinc.com/blog/when-to-use-a-301-vs-302-redirect/">Bigoak Inc</a>:</p>
<blockquote class="border-l-4 border-gray-300 pl-4">
<p>All three major search engines handle 301 redirects the same, that is to say they ignore the original URL and instead index the destination URL.</p>
</blockquote>
<blockquote class="border-l-4 border-gray-300 pl-4">
<p>The three major engines handle 302 redirects very differently, and because of this 302s are typically not recommended.</p>
</blockquote>
<p>Best practice is to use 301 redirects (which are permanent and are usually cached by the browser).  For temporary moves, use 302 redirects.</p>
<h2>Force IE to Use Unicode for Parameters</h2>
<p>If you have ever seen <code>utf8=✓</code> in the parameter listing of a url, it&#x27;s in order to <a href="http://stackoverflow.com/questions/3222013/what-is-the-snowman-param-in-ruby-on-rails-3-forms-for/3348524#3348524">force Internet Explorer (5, 6, 7 and 8) to encode its parameters as unicode</a>.</p>


This post was originally on a blog I started for creating web applications. This post goes into using web standards and best practices.

## Check that GET and POST Requests are Used Properly

`GET` request should be for requesting information.

`POST` requests should be for sending information.

A `GET` request should not change the object that is being requests.

## Validate your HTML and CSS

Write your [XHTML](http://www.w3.org/TR/xhtml1/) or [HTML](http://www.w3.org/TR/REC-html40/) and [CSS](http://www.w3.org/TR/CSS2/) according to [the W3C specifications](http://www.w3.org/TR/) and make sure they [validate](http://validator.w3.org/).

Avoid browser quirks modes by doing this.

## Use 301 and 302 Redirects Correctly

According to [Bigoak Inc](http://www.bigoakinc.com/blog/when-to-use-a-301-vs-302-redirect/):

> All three major search engines handle 301 redirects the same, that is to say they ignore the original URL and instead index the destination URL.

> The three major engines handle 302 redirects very differently, and because of this 302s are typically not recommended.

Best practice is to use 301 redirects (which are permanent and are usually cached by the browser).  For temporary moves, use 302 redirects.

## Force IE to Use Unicode for Parameters

If you have ever seen `utf8=✓` in the parameter listing of a url, it's in order to [force Internet Explorer (5, 6, 7 and 8) to encode its parameters as unicode](http://stackoverflow.com/questions/3222013/what-is-the-snowman-param-in-ruby-on-rails-3-forms-for/3348524#3348524).  


Web Standards

/*@jsxRuntime automatic @jsxImportSource react*/
const {Fragment: _Fragment, jsx: _jsx, jsxs: _jsxs} = arguments[0];
function _createMdxContent(props) {
  const _components = Object.assign({
    p: "p",
    h2: "h2",
    ul: "ul",
    li: "li",
    input: "input",
    a: "a",
    code: "code",
    pre: "pre"
  }, props.components);
  return _jsxs(_Fragment, {
    children: [_jsx(_components.p, {
      children: "This post was originally on a blog I started for creating web applications. This post goes into User Interface design for web applications."
    }), "\n", _jsx(_components.p, {
      children: "User Experience is one of the most important parts of web applications."
    }), "\n", _jsx(_components.p, {
      children: "The following are tips and questions to consider when working on your web application user interface."
    }), "\n", _jsx(_components.h2, {
      children: "Test for Consistency Between Browsers"
    }), "\n", _jsx(_components.p, {
      children: "Are there tests for consistency with:"
    }), "\n", _jsxs(_components.ul, {
      className: "contains-task-list",
      children: ["\n", _jsxs(_components.li, {
        className: "task-list-item",
        children: [_jsx(_components.input, {
          type: "checkbox",
          disabled: true
        }), " ", "The ", _jsx(_components.a, {
          href: "http://en.wikipedia.org/wiki/Gecko_%28layout_engine%29",
          children: "Gecko"
        }), " engine - i.e. ", _jsx(_components.a, {
          href: "http://firefox.com/",
          children: "Firefox"
        }), "."]
      }), "\n", _jsxs(_components.li, {
        className: "task-list-item",
        children: [_jsx(_components.input, {
          type: "checkbox",
          disabled: true
        }), " ", "The Webkit engine - i.e. ", _jsx(_components.a, {
          href: "http://www.apple.com/safari/",
          children: "Safari"
        }), "."]
      }), "\n", _jsxs(_components.li, {
        className: "task-list-item",
        children: [_jsx(_components.input, {
          type: "checkbox",
          disabled: true
        }), " ", _jsx(_components.a, {
          href: "http://www.google.com/chrome",
          children: "Chrome"
        }), "."]
      }), "\n", _jsxs(_components.li, {
        className: "task-list-item",
        children: [_jsx(_components.input, {
          type: "checkbox",
          disabled: true
        }), " ", _jsx(_components.a, {
          href: "http://www.opera.com/",
          children: "Opera"
        }), "."]
      }), "\n", _jsxs(_components.li, {
        className: "task-list-item",
        children: [_jsx(_components.input, {
          type: "checkbox",
          disabled: true
        }), " ", "IE Browsers - take advantage of the ", _jsx(_components.a, {
          href: "http://www.microsoft.com/Downloads/details.aspx?FamilyID=21eabb90-958f-4b64-b5f1-73d0a413c8ef&displaylang=en",
          children: "Application Compatibility VPC Images"
        }), "."]
      }), "\n"]
    }), "\n", _jsxs(_components.p, {
      children: ["For IE Browsers, there is a Github project call ", _jsx(_components.a, {
        href: "https://github.com/xdissent/ievms",
        children: "ievms"
      }), " which provides Virtual Machines with IE6, IE7, IE8, IE8, IE10, and IE11."]
    }), "\n", _jsxs(_components.p, {
      children: ["Also consider how the same browser will render your site on differnet operating systems. Consider a service like ", _jsx(_components.a, {
        href: "http://www.browsershots.org/",
        children: "Browsershots"
      }), " or ", _jsx(_components.a, {
        href: "https://litmus.com/",
        children: "Litmus"
      }), "."]
    }), "\n", _jsx(_components.h2, {
      children: "Do your Positive, Negative, and Neutral Buttons look different?"
    }), "\n", _jsxs(_components.p, {
      children: ["Image from ", _jsx(_components.a, {
        href: "http://uxmovement.com/buttons/how-button-color-contrast-guides-users-to-action/",
        children: "UX Movement"
      }), "."]
    }), "\n", _jsx(_components.p, {
      children: "Have your Positive Action buttons and your Neutral and Negative Action buttons look distinctly different.  Notice that in the above example, not only are the colors different, but one is bordered and ther other is filled in, making it accessible to those with color-blindness."
    }), "\n", _jsx(_components.h2, {
      children: "Test for Mobile Consistency"
    }), "\n", _jsx(_components.p, {
      children: "Are there tests for consistency with:"
    }), "\n", _jsxs(_components.ul, {
      className: "contains-task-list",
      children: ["\n", _jsxs(_components.li, {
        className: "task-list-item",
        children: [_jsx(_components.input, {
          type: "checkbox",
          disabled: true
        }), " ", "Android phones and tablets"]
      }), "\n", _jsxs(_components.li, {
        className: "task-list-item",
        children: [_jsx(_components.input, {
          type: "checkbox",
          disabled: true
        }), " ", "iOS phones and tablets"]
      }), "\n", _jsxs(_components.li, {
        className: "task-list-item",
        children: [_jsx(_components.input, {
          type: "checkbox",
          disabled: true
        }), " ", "Screen readers"]
      }), "\n", _jsxs(_components.li, {
        className: "task-list-item",
        children: [_jsx(_components.input, {
          type: "checkbox",
          disabled: true
        }), " ", "Search engines"]
      }), "\n"]
    }), "\n", _jsx(_components.p, {
      children: "For more information, check out Mobile and Developer Tools."
    }), "\n", _jsx(_components.h2, {
      children: "Do you have a staging environment?"
    }), "\n", _jsx(_components.p, {
      children: "Can you deploy updates without affecting your users?"
    }), "\n", _jsx(_components.p, {
      children: "Testing and staging environments are important for being able to test features, architecture, etc without breaking the user's session."
    }), "\n", _jsxs(_components.p, {
      children: ["Have an automated way of deploying approved changes to the live site. Consider using a version control system with an automated build system (something like ", _jsx(_components.a, {
        href: "http://maven.apache.org/",
        children: "Maven"
      }), ")."]
    }), "\n", _jsx(_components.h2, {
      children: "Are errors handled in a friendly matter?"
    }), "\n", _jsx(_components.p, {
      children: "Users should receive easy to read error messages."
    }), "\n", _jsx(_components.p, {
      children: "Users should never see:"
    }), "\n", _jsxs(_components.ul, {
      children: ["\n", _jsx(_components.li, {
        children: "Out Of Memory errors"
      }), "\n", _jsx(_components.li, {
        children: "Raw 404 pages"
      }), "\n", _jsx(_components.li, {
        children: "Stack Traces"
      }), "\n"]
    }), "\n", _jsx(_components.h2, {
      children: "Is user info crawlable on public pages?"
    }), "\n", _jsx(_components.p, {
      children: "Try not to have users' email in plain text on public facing pages.  They might get spammed."
    }), "\n", _jsxs(_components.h2, {
      children: ["Is the ", _jsx(_components.code, {
        children: "rel=\"nofollow\""
      }), " attribute on user-generated links?"]
    }), "\n", _jsxs(_components.p, {
      children: ["Avoid spam by putting the ", _jsx(_components.a, {
        href: "http://en.wikipedia.org/wiki/Nofollow",
        children: "nofollow"
      }), " on user generated links."]
    }), "\n", _jsx(_components.h2, {
      children: "Does your site have built in rate limiting and velocity checking?"
    }), "\n", _jsx(_components.p, {
      children: "Any user actions should have rate limiting and velocity checking built in.  This is also a security issue."
    }), "\n", _jsxs(_components.p, {
      children: ["Look into ", _jsx(_components.a, {
        href: "http://blog.codinghorror.com/rate-limiting-and-velocity-checking/",
        children: "Coding Horror's post on rate limiting and velocity checking"
      }), " for more information."]
    }), "\n", _jsx(_components.h2, {
      children: "No inline styles"
    }), "\n", _jsx(_components.p, {
      children: "All CSS should be in stylesheets."
    }), "\n", _jsx(_components.h2, {
      children: "Accessibility"
    }), "\n", _jsx(_components.p, {
      children: "Check to make sure your website is navigable from screen readers."
    }), "\n", _jsxs(_components.p, {
      children: ["If you are using ", _jsx(_components.a, {
        href: "http://getbootstrap.com/",
        children: "Twitter Bootstrap"
      }), ", look into the ", _jsx(_components.a, {
        href: "http://paypal.github.io/bootstrap-accessibility-plugin/",
        children: "Bootstrap accessibility plugin"
      }), "."]
    }), "\n", _jsxs(_components.p, {
      children: ["If you are using ", _jsx(_components.a, {
        href: "http://foundation.zurb.com/",
        children: "Foundation"
      }), ", look into how ", _jsx(_components.a, {
        href: "http://zurb.com/article/1337/foundation-now-helps-you-build-accessible",
        children: "Foundation is built around accessibility"
      }), "."]
    }), "\n", _jsx(_components.p, {
      children: "For more on accessibility, see the full page on Accessibility."
    }), "\n", _jsx(_components.h2, {
      children: "Are you using HTML5?"
    }), "\n", _jsxs(_components.p, {
      children: ["If you can, start out by using HTML5.  If you do so, remember to include the ", _jsx(_components.a, {
        href: "http://en.wikipedia.org/wiki/HTML5_Shiv",
        children: "HTML5 Shiv"
      }), " (or Shim) so that IE version before 9 can use HTML5 elements."]
    }), "\n", _jsxs(_components.p, {
      children: ["Look into ", _jsx(_components.a, {
        href: "http://html5boilerplate.com/",
        children: "HTML5 Boilerplate"
      }), " or ", _jsx(_components.a, {
        href: "http://www.initializr.com/",
        children: "Initialzr"
      }), " for an HTML5 boilerplate that comes with the HTML5 shim, normalize.css, and Modernizr."]
    }), "\n", _jsx(_components.h2, {
      children: "Consider Using Normalize.css"
    }), "\n", _jsxs(_components.p, {
      children: ["Consider reseting the browser style sheets or using ", _jsx(_components.a, {
        href: "http://necolas.github.io/normalize.css/",
        children: "normalize.css"
      }), " for consistency between browsers."]
    }), "\n", _jsx(_components.h2, {
      children: "Are you using Semantic HTML?"
    }), "\n", _jsxs(_components.p, {
      children: ["Recent HTML standards discourage the use of the ", _jsx(_components.code, {
        children: "<i>"
      }), " in preference for the ", _jsx(_components.code, {
        children: "<em>"
      }), " tag. Other HTML5 tas to consider using are:"]
    }), "\n", _jsxs(_components.ul, {
      children: ["\n", _jsx(_components.li, {
        children: _jsx(_components.code, {
          children: "<article>"
        })
      }), "\n", _jsx(_components.li, {
        children: _jsx(_components.code, {
          children: "<aside>"
        })
      }), "\n", _jsx(_components.li, {
        children: _jsx(_components.code, {
          children: "<details>"
        })
      }), "\n", _jsx(_components.li, {
        children: _jsx(_components.code, {
          children: "<figcaption>"
        })
      }), "\n", _jsx(_components.li, {
        children: _jsx(_components.code, {
          children: "<figure>"
        })
      }), "\n", _jsx(_components.li, {
        children: _jsx(_components.code, {
          children: "<footer>"
        })
      }), "\n", _jsx(_components.li, {
        children: _jsx(_components.code, {
          children: "<header>"
        })
      }), "\n", _jsx(_components.li, {
        children: _jsx(_components.code, {
          children: "<main>"
        })
      }), "\n", _jsx(_components.li, {
        children: _jsx(_components.code, {
          children: "<mark>"
        })
      }), "\n", _jsx(_components.li, {
        children: _jsx(_components.code, {
          children: "<nav>"
        })
      }), "\n", _jsx(_components.li, {
        children: _jsx(_components.code, {
          children: "<section>"
        })
      }), "\n", _jsx(_components.li, {
        children: _jsx(_components.code, {
          children: "<summary>"
        })
      }), "\n", _jsx(_components.li, {
        children: _jsx(_components.code, {
          children: "<time>"
        })
      }), "\n"]
    }), "\n", _jsx(_components.h2, {
      children: "Redirect after a POST"
    }), "\n", _jsx(_components.p, {
      children: "After a user POSTs data, redirect to a success page, to prevent a refresh from submitting data again."
    }), "\n", _jsx(_components.h2, {
      children: "Use Progressive Enhancement"
    }), "\n", _jsx(_components.p, {
      children: "Allow graceful degradation of your website."
    }), "\n", _jsxs(_components.ul, {
      className: "contains-task-list",
      children: ["\n", _jsxs(_components.li, {
        className: "task-list-item",
        children: [_jsx(_components.input, {
          type: "checkbox",
          disabled: true
        }), " ", "Basic content should be accessible to all web browsers"]
      }), "\n", _jsxs(_components.li, {
        className: "task-list-item",
        children: [_jsx(_components.input, {
          type: "checkbox",
          disabled: true
        }), " ", "Basic functionality should be accessible to all web browsers"]
      }), "\n", _jsxs(_components.li, {
        className: "task-list-item",
        children: [_jsx(_components.input, {
          type: "checkbox",
          disabled: true
        }), " ", "Sparse, semantic markup contains all content"]
      }), "\n", _jsxs(_components.li, {
        className: "task-list-item",
        children: [_jsx(_components.input, {
          type: "checkbox",
          disabled: true
        }), " ", "Enhanced layout is provided by externally linked CSS"]
      }), "\n", _jsxs(_components.li, {
        className: "task-list-item",
        children: [_jsx(_components.input, {
          type: "checkbox",
          disabled: true
        }), " ", "Enhanced behavior is provided by unobtrusive, externally linked JavaScript"]
      }), "\n", _jsxs(_components.li, {
        className: "task-list-item",
        children: [_jsx(_components.input, {
          type: "checkbox",
          disabled: true
        }), " ", "End-user web browser preferences are respected"]
      }), "\n"]
    }), "\n", _jsxs(_components.p, {
      children: ["See ", _jsx(_components.a, {
        href: "http://en.wikipedia.org/wiki/Progressive_enhancement",
        children: "Progressive Enhancement"
      }), " for more information."]
    }), "\n", _jsx(_components.h2, {
      children: "Validate Forms"
    }), "\n", _jsx(_components.p, {
      children: "Going along with Security, make sure to validate all form input on the server side and give useful errors back to the user.  Once proper form security handling has been implemented, add in client side validation.  You can use HTML5's simple validation to add a small layer of responsive validation:"
    }), "\n", _jsx(_components.pre, {
      children: _jsx(_components.code, {
        className: "language-html",
        children: "<input id=\"username\" placeholder=\"John Jones\" required>\n"
      })
    }), "\n", _jsxs(_components.p, {
      children: ["You can use the ", _jsx(_components.code, {
        children: "required"
      }), " attribute to let users know on the client side before they submit their form that a field is required."]
    }), "\n", _jsx(_components.p, {
      children: "You can use the new input type to help with input validation as well:"
    }), "\n", _jsx(_components.pre, {
      children: _jsx(_components.code, {
        className: "language-html",
        children: "<input type=\"email\" required>\n"
      })
    }), "\n", _jsx(_components.p, {
      children: "You can mark invalid input with CSS as well:"
    }), "\n", _jsx(_components.pre, {
      children: _jsx(_components.code, {
        className: "language-css",
        children: "input:required:invalid {\n  background: red;\n}\n"
      })
    }), "\n", _jsxs(_components.p, {
      children: ["Checkout ", _jsx(_components.a, {
        href: "http://basicuse.net/articles/pl/textile/html_css/form_validation_in_html5",
        children: "Form Validation in HTML 5"
      }), " for more information."]
    }), "\n", _jsx(_components.h2, {
      children: "Use CSS Animations over JavaScript Animations"
    }), "\n", _jsxs(_components.p, {
      children: ["You can now use CSS animations instead of relying on JavaScript.  You can read more about CSS animations on the ", _jsx(_components.a, {
        href: "https://developer.mozilla.org/en-US/docs/Web/Guide/CSS/Using_CSS_animations",
        children: "Mozilla Developer Network"
      }), "."]
    }), "\n", _jsx(_components.h2, {
      children: "Look at Little Big Details"
    }), "\n", _jsxs(_components.p, {
      children: [_jsx(_components.a, {
        href: "http://littlebigdetails.com/",
        children: "Little Big Details"
      }), " contains design inspiration from the point of view of the users."]
    }), "\n", _jsx(_components.p, {
      children: "For more websites about UI, look at our developer tools list."
    }), "\n", _jsx(_components.h2, {
      children: "Responsive Grids"
    }), "\n", _jsx(_components.p, {
      children: "Having a responsve layout is great for creating one application that looks good on mobile and desktop devices.  A Responsive Layout can be achieved by using popular frameworks like:"
    }), "\n", _jsxs(_components.ul, {
      children: ["\n", _jsx(_components.li, {
        children: _jsx(_components.a, {
          href: "http://getbootstrap.com/",
          children: "Bootstrap"
        })
      }), "\n", _jsx(_components.li, {
        children: _jsx(_components.a, {
          href: "http://semantic-ui.com/",
          children: "SemanticUI"
        })
      }), "\n", _jsx(_components.li, {
        children: _jsx(_components.a, {
          href: "http://foundation.zurb.com/",
          children: "Foundation"
        })
      }), "\n"]
    }), "\n", _jsx(_components.p, {
      children: "and more."
    }), "\n", _jsxs(_components.p, {
      children: ["You can also create a custom grid if the above frameworks are too large for you to use.  Check out ", _jsx(_components.a, {
        href: "http://jordanlev.github.io/grid/",
        children: "this tutorial on Minimal Responsive Grids"
      }), "."]
    })]
  });
}
function MDXContent(props = {}) {
  const {wrapper: MDXLayout} = props.components || ({});
  return MDXLayout ? _jsx(MDXLayout, Object.assign({}, props, {
    children: _jsx(_createMdxContent, props)
  })) : _createMdxContent(props);
}
return {
  default: MDXContent
};


<p>This post was originally on a blog I started for creating web applications. This post goes into User Interface design for web applications.</p>
<p>User Experience is one of the most important parts of web applications.</p>
<p>The following are tips and questions to consider when working on your web application user interface.</p>
<h2>Test for Consistency Between Browsers</h2>
<p>Are there tests for consistency with:</p>
<ul class="contains-task-list">
<li class="task-list-item"><input type="checkbox" disabled=""/> The <a href="http://en.wikipedia.org/wiki/Gecko_%28layout_engine%29">Gecko</a> engine - i.e. <a href="http://firefox.com/">Firefox</a>.</li>
<li class="task-list-item"><input type="checkbox" disabled=""/> The Webkit engine - i.e. <a href="http://www.apple.com/safari/">Safari</a>.</li>
<li class="task-list-item"><input type="checkbox" disabled=""/> <a href="http://www.google.com/chrome">Chrome</a>.</li>
<li class="task-list-item"><input type="checkbox" disabled=""/> <a href="http://www.opera.com/">Opera</a>.</li>
<li class="task-list-item"><input type="checkbox" disabled=""/> IE Browsers - take advantage of the <a href="http://www.microsoft.com/Downloads/details.aspx?FamilyID=21eabb90-958f-4b64-b5f1-73d0a413c8ef&amp;displaylang=en">Application Compatibility VPC Images</a>.</li>
</ul>
<p>For IE Browsers, there is a Github project call <a href="https://github.com/xdissent/ievms">ievms</a> which provides Virtual Machines with IE6, IE7, IE8, IE8, IE10, and IE11.</p>
<p>Also consider how the same browser will render your site on differnet operating systems. Consider a service like <a href="http://www.browsershots.org/">Browsershots</a> or <a href="https://litmus.com/">Litmus</a>.</p>
<h2>Do your Positive, Negative, and Neutral Buttons look different?</h2>
<p>Image from <a href="http://uxmovement.com/buttons/how-button-color-contrast-guides-users-to-action/">UX Movement</a>.</p>
<p>Have your Positive Action buttons and your Neutral and Negative Action buttons look distinctly different.  Notice that in the above example, not only are the colors different, but one is bordered and ther other is filled in, making it accessible to those with color-blindness.</p>
<h2>Test for Mobile Consistency</h2>
<p>Are there tests for consistency with:</p>
<ul class="contains-task-list">
<li class="task-list-item"><input type="checkbox" disabled=""/> Android phones and tablets</li>
<li class="task-list-item"><input type="checkbox" disabled=""/> iOS phones and tablets</li>
<li class="task-list-item"><input type="checkbox" disabled=""/> Screen readers</li>
<li class="task-list-item"><input type="checkbox" disabled=""/> Search engines</li>
</ul>
<p>For more information, check out Mobile and Developer Tools.</p>
<h2>Do you have a staging environment?</h2>
<p>Can you deploy updates without affecting your users?</p>
<p>Testing and staging environments are important for being able to test features, architecture, etc without breaking the user&#x27;s session.</p>
<p>Have an automated way of deploying approved changes to the live site. Consider using a version control system with an automated build system (something like <a href="http://maven.apache.org/">Maven</a>).</p>
<h2>Are errors handled in a friendly matter?</h2>
<p>Users should receive easy to read error messages.</p>
<p>Users should never see:</p>
<ul>
<li>Out Of Memory errors</li>
<li>Raw 404 pages</li>
<li>Stack Traces</li>
</ul>
<h2>Is user info crawlable on public pages?</h2>
<p>Try not to have users&#x27; email in plain text on public facing pages.  They might get spammed.</p>
<h2>Is the <code>rel=&quot;nofollow&quot;</code> attribute on user-generated links?</h2>
<p>Avoid spam by putting the <a href="http://en.wikipedia.org/wiki/Nofollow">nofollow</a> on user generated links.</p>
<h2>Does your site have built in rate limiting and velocity checking?</h2>
<p>Any user actions should have rate limiting and velocity checking built in.  This is also a security issue.</p>
<p>Look into <a href="http://blog.codinghorror.com/rate-limiting-and-velocity-checking/">Coding Horror&#x27;s post on rate limiting and velocity checking</a> for more information.</p>
<h2>No inline styles</h2>
<p>All CSS should be in stylesheets.</p>
<h2>Accessibility</h2>
<p>Check to make sure your website is navigable from screen readers.</p>
<p>If you are using <a href="http://getbootstrap.com/">Twitter Bootstrap</a>, look into the <a href="http://paypal.github.io/bootstrap-accessibility-plugin/">Bootstrap accessibility plugin</a>.</p>
<p>If you are using <a href="http://foundation.zurb.com/">Foundation</a>, look into how <a href="http://zurb.com/article/1337/foundation-now-helps-you-build-accessible">Foundation is built around accessibility</a>.</p>
<p>For more on accessibility, see the full page on Accessibility.</p>
<h2>Are you using HTML5?</h2>
<p>If you can, start out by using HTML5.  If you do so, remember to include the <a href="http://en.wikipedia.org/wiki/HTML5_Shiv">HTML5 Shiv</a> (or Shim) so that IE version before 9 can use HTML5 elements.</p>
<p>Look into <a href="http://html5boilerplate.com/">HTML5 Boilerplate</a> or <a href="http://www.initializr.com/">Initialzr</a> for an HTML5 boilerplate that comes with the HTML5 shim, normalize.css, and Modernizr.</p>
<h2>Consider Using Normalize.css</h2>
<p>Consider reseting the browser style sheets or using <a href="http://necolas.github.io/normalize.css/">normalize.css</a> for consistency between browsers.</p>
<h2>Are you using Semantic HTML?</h2>
<p>Recent HTML standards discourage the use of the <code>&lt;i&gt;</code> in preference for the <code>&lt;em&gt;</code> tag. Other HTML5 tas to consider using are:</p>
<ul>
<li><code>&lt;article&gt;</code></li>
<li><code>&lt;aside&gt;</code></li>
<li><code>&lt;details&gt;</code></li>
<li><code>&lt;figcaption&gt;</code></li>
<li><code>&lt;figure&gt;</code></li>
<li><code>&lt;footer&gt;</code></li>
<li><code>&lt;header&gt;</code></li>
<li><code>&lt;main&gt;</code></li>
<li><code>&lt;mark&gt;</code></li>
<li><code>&lt;nav&gt;</code></li>
<li><code>&lt;section&gt;</code></li>
<li><code>&lt;summary&gt;</code></li>
<li><code>&lt;time&gt;</code></li>
</ul>
<h2>Redirect after a POST</h2>
<p>After a user POSTs data, redirect to a success page, to prevent a refresh from submitting data again.</p>
<h2>Use Progressive Enhancement</h2>
<p>Allow graceful degradation of your website.</p>
<ul class="contains-task-list">
<li class="task-list-item"><input type="checkbox" disabled=""/> Basic content should be accessible to all web browsers</li>
<li class="task-list-item"><input type="checkbox" disabled=""/> Basic functionality should be accessible to all web browsers</li>
<li class="task-list-item"><input type="checkbox" disabled=""/> Sparse, semantic markup contains all content</li>
<li class="task-list-item"><input type="checkbox" disabled=""/> Enhanced layout is provided by externally linked CSS</li>
<li class="task-list-item"><input type="checkbox" disabled=""/> Enhanced behavior is provided by unobtrusive, externally linked JavaScript</li>
<li class="task-list-item"><input type="checkbox" disabled=""/> End-user web browser preferences are respected</li>
</ul>
<p>See <a href="http://en.wikipedia.org/wiki/Progressive_enhancement">Progressive Enhancement</a> for more information.</p>
<h2>Validate Forms</h2>
<p>Going along with Security, make sure to validate all form input on the server side and give useful errors back to the user.  Once proper form security handling has been implemented, add in client side validation.  You can use HTML5&#x27;s simple validation to add a small layer of responsive validation:</p>
<div class="overflow-auto rounded bg-gray-200 p-4 font-mono text-sm dark:bg-gray-800 dark:text-gray-100"><pre><code class="language-html">&lt;input id=&quot;username&quot; placeholder=&quot;John Jones&quot; required&gt;
</code></pre></div>
<p>You can use the <code>required</code> attribute to let users know on the client side before they submit their form that a field is required.</p>
<p>You can use the new input type to help with input validation as well:</p>
<div class="overflow-auto rounded bg-gray-200 p-4 font-mono text-sm dark:bg-gray-800 dark:text-gray-100"><pre><code class="language-html">&lt;input type=&quot;email&quot; required&gt;
</code></pre></div>
<p>You can mark invalid input with CSS as well:</p>
<div class="overflow-auto rounded bg-gray-200 p-4 font-mono text-sm dark:bg-gray-800 dark:text-gray-100"><pre><code class="language-css">input:required:invalid {
  background: red;
}
</code></pre></div>
<p>Checkout <a href="http://basicuse.net/articles/pl/textile/html_css/form_validation_in_html5">Form Validation in HTML 5</a> for more information.</p>
<h2>Use CSS Animations over JavaScript Animations</h2>
<p>You can now use CSS animations instead of relying on JavaScript.  You can read more about CSS animations on the <a href="https://developer.mozilla.org/en-US/docs/Web/Guide/CSS/Using_CSS_animations">Mozilla Developer Network</a>.</p>
<h2>Look at Little Big Details</h2>
<p><a href="http://littlebigdetails.com/">Little Big Details</a> contains design inspiration from the point of view of the users.</p>
<p>For more websites about UI, look at our developer tools list.</p>
<h2>Responsive Grids</h2>
<p>Having a responsve layout is great for creating one application that looks good on mobile and desktop devices.  A Responsive Layout can be achieved by using popular frameworks like:</p>
<ul>
<li><a href="http://getbootstrap.com/">Bootstrap</a></li>
<li><a href="http://semantic-ui.com/">SemanticUI</a></li>
<li><a href="http://foundation.zurb.com/">Foundation</a></li>
</ul>
<p>and more.</p>
<p>You can also create a custom grid if the above frameworks are too large for you to use.  Check out <a href="http://jordanlev.github.io/grid/">this tutorial on Minimal Responsive Grids</a>.</p>


This post was originally on a blog I started for creating web applications. This post goes into User Interface design for web applications.

User Experience is one of the most important parts of web applications.

The following are tips and questions to consider when working on your web application user interface.

## Test for Consistency Between Browsers

Are there tests for consistency with:

- [ ] The [Gecko](http://en.wikipedia.org/wiki/Gecko_%28layout_engine%29) engine - i.e. [Firefox](http://firefox.com/).
- [ ] The Webkit engine - i.e. [Safari](http://www.apple.com/safari/).
- [ ] [Chrome](http://www.google.com/chrome).
- [ ] [Opera](http://www.opera.com/).
- [ ] IE Browsers - take advantage of the [Application Compatibility VPC Images](http://www.microsoft.com/Downloads/details.aspx?FamilyID=21eabb90-958f-4b64-b5f1-73d0a413c8ef&displaylang=en).

For IE Browsers, there is a Github project call [ievms](https://github.com/xdissent/ievms) which provides Virtual Machines with IE6, IE7, IE8, IE8, IE10, and IE11.

Also consider how the same browser will render your site on differnet operating systems. Consider a service like [Browsershots](http://www.browsershots.org/) or [Litmus](https://litmus.com/).

## Do your Positive, Negative, and Neutral Buttons look different?

Image from [UX Movement](http://uxmovement.com/buttons/how-button-color-contrast-guides-users-to-action/).

Have your Positive Action buttons and your Neutral and Negative Action buttons look distinctly different.  Notice that in the above example, not only are the colors different, but one is bordered and ther other is filled in, making it accessible to those with color-blindness.

## Test for Mobile Consistency

Are there tests for consistency with:

- [ ] Android phones and tablets
- [ ] iOS phones and tablets
- [ ] Screen readers
- [ ] Search engines

For more information, check out Mobile and Developer Tools.

## Do you have a staging environment?

Can you deploy updates without affecting your users?

Testing and staging environments are important for being able to test features, architecture, etc without breaking the user's session.

Have an automated way of deploying approved changes to the live site. Consider using a version control system with an automated build system (something like [Maven](http://maven.apache.org/)).

## Are errors handled in a friendly matter?

Users should receive easy to read error messages.

Users should never see:

- Out Of Memory errors
- Raw 404 pages
- Stack Traces

## Is user info crawlable on public pages?

Try not to have users' email in plain text on public facing pages.  They might get spammed.

## Is the `rel="nofollow"` attribute on user-generated links?

Avoid spam by putting the [nofollow](http://en.wikipedia.org/wiki/Nofollow) on user generated links.

## Does your site have built in rate limiting and velocity checking?

Any user actions should have rate limiting and velocity checking built in.  This is also a security issue.

Look into [Coding Horror's post on rate limiting and velocity checking](http://blog.codinghorror.com/rate-limiting-and-velocity-checking/) for more information.

## No inline styles

All CSS should be in stylesheets.

## Accessibility

Check to make sure your website is navigable from screen readers.

If you are using [Twitter Bootstrap](http://getbootstrap.com/), look into the [Bootstrap accessibility plugin](http://paypal.github.io/bootstrap-accessibility-plugin/).

If you are using [Foundation](http://foundation.zurb.com/), look into how [Foundation is built around accessibility](http://zurb.com/article/1337/foundation-now-helps-you-build-accessible).

For more on accessibility, see the full page on Accessibility.

## Are you using HTML5?

If you can, start out by using HTML5.  If you do so, remember to include the [HTML5 Shiv](http://en.wikipedia.org/wiki/HTML5_Shiv) (or Shim) so that IE version before 9 can use HTML5 elements.

Look into [HTML5 Boilerplate](http://html5boilerplate.com/) or [Initialzr](http://www.initializr.com/) for an HTML5 boilerplate that comes with the HTML5 shim, normalize.css, and Modernizr.

## Consider Using Normalize.css

Consider reseting the browser style sheets or using [normalize.css](http://necolas.github.io/normalize.css/) for consistency between browsers.

## Are you using Semantic HTML?

Recent HTML standards discourage the use of the `<i>` in preference for the `<em>` tag. Other HTML5 tas to consider using are:

- `<article>`
- `<aside>`
- `<details>`
- `<figcaption>`
- `<figure>`
- `<footer>`
- `<header>`
- `<main>`
- `<mark>`
- `<nav>`
- `<section>`
- `<summary>`
- `<time>`

## Redirect after a POST

After a user POSTs data, redirect to a success page, to prevent a refresh from submitting data again.

## Use Progressive Enhancement

Allow graceful degradation of your website.

- [ ] Basic content should be accessible to all web browsers
- [ ] Basic functionality should be accessible to all web browsers
- [ ] Sparse, semantic markup contains all content
- [ ] Enhanced layout is provided by externally linked CSS
- [ ] Enhanced behavior is provided by unobtrusive, externally linked JavaScript
- [ ] End-user web browser preferences are respected

See [Progressive Enhancement](http://en.wikipedia.org/wiki/Progressive_enhancement) for more information.

## Validate Forms

Going along with Security, make sure to validate all form input on the server side and give useful errors back to the user.  Once proper form security handling has been implemented, add in client side validation.  You can use HTML5's simple validation to add a small layer of responsive validation:

```html
<input id="username" placeholder="John Jones" required>
```

You can use the `required` attribute to let users know on the client side before they submit their form that a field is required.

You can use the new input type to help with input validation as well:

```html
<input type="email" required>
```

You can mark invalid input with CSS as well:

```css
input:required:invalid {
  background: red;
}
```

Checkout [Form Validation in HTML 5](http://basicuse.net/articles/pl/textile/html_css/form_validation_in_html5) for more information.

## Use CSS Animations over JavaScript Animations

You can now use CSS animations instead of relying on JavaScript.  You can read more about CSS animations on the [Mozilla Developer Network](https://developer.mozilla.org/en-US/docs/Web/Guide/CSS/Using_CSS_animations).

## Look at Little Big Details

[Little Big Details](http://littlebigdetails.com/) contains design inspiration from the point of view of the users.

For more websites about UI, look at our developer tools list.

## Responsive Grids

Having a responsve layout is great for creating one application that looks good on mobile and desktop devices.  A Responsive Layout can be achieved by using popular frameworks like:

- [Bootstrap](http://getbootstrap.com/)
- [SemanticUI](http://semantic-ui.com/)
- [Foundation](http://foundation.zurb.com/)

and more.

You can also create a custom grid if the above frameworks are too large for you to use.  Check out [this tutorial on Minimal Responsive Grids](http://jordanlev.github.io/grid/).
