100 'Security Checklist' yang Wajib dilakukan Website ber-PHP

Menjadi seorang programmer web harus memperhatikan banyak hal, khususnya programmer web berbasis PHP. Namun ada sebuah faktor penting yang terkadang terlupakan dan sering diabaikan, yaitu masalah security atau keamanan website. Faktor keamanan sangatlah penting bagi sebuah website. Walaupun "tidak ada sistem yang sempurna", bukan berarti faktor keamanan harus diabaikan. Tidak mudah bahkan hampir tidak mungkin untuk membuat sebuah website yang bebas celah dan anti serangan peretas. Setidaknya dengan cara ini kita bisa meminimalisir celah-celah pada website kita.

Ilustrasi security checklist (sumber : www.lifehacker.com.au)

Berikut ini adalah 100 poin yang sangat penting yang harus kalian lakukan jika kalian adalah seorang programmer PHP yang ingin membuat website atau aplikasi kalian aman dari serangan-serangan, walupun tidak 100% aman. Setidaknya kalian sudah mencoba untuk meminimalisir kemungkinan buruk yang akan menimpa website kalian.

BASIC

Berisi tentang hal-hal dasar mengenai keamanan sebuah website dengan PHP.

• Strong passwords are used.
• Passwords stored safely.
• register_globals is disabled.
• magic_quotes is disabled.
• display_errors is disabled.
• Server(s) are physically secured.

INPUT

Berisi tentang segala hal yang bergubungan dengan input form pada sebuah website. Jika website kalian memiliki input form, maka hal ini harus kalian perhatikan dengan baik.

• Input form $_GET, $_POST, $_COOKIE and $_REQUEST is considerend tainted.
• Understood that only some values in $_SERVER and $_ENV are untainted.
• $_SERVER['PHP_SELF'] is used where used.
• Input data is validated.
• \o (null) is discardedin input.
• Length of input is bounded.
• Email addresses are validated.
• Application is aware of small, very large, zor and negative numbers. Sci. notation too.
• Application checks for invisible, look-alike, and combining characters.
• Unicode control characters stripped out when required.
• Output data is sanitized.
• User-inputted HTML is sanitized with HTMLPurifier.
• User-inputted CSS is sanitized using a white-list
• Abusable properties (margin, position, etc.) are handled.
• CSS escape sequences are handled.
• Javascript in CSS is discarded (expressions, behaviors, bindings.)
• URLs are sanitized and unknown and unwanted protocols are disallowed.
• Embedded plugin files (Flash Movies) are embedded in a manner so that only the intended plugin is loaded.
• The application uses a safe encoding.
• An encoding is specified using a HTTP header.
• Inputted data is verified to be valid for your selected encoding if using an unsafe encoding.

Ilustrasi file upload (sumber : mint.stikom-db.ac.id)

FILE UPLOADS

Poin ini berisi tentang upload form pada sebuah website. Jika website kalian melibatkan upload form untuk gambar atau file, kalian jangan melewatkan poin ini.

• Application verifies file type.
• User provided mime type value is ignored.
• Application analyzes the content of files to determinie their type.
• It is understood that a perfectly valid file can still contain arbritrary data.
• Application checks the file size of uploaded files.
• MAX_FILE_SIZE is not depended upon.
• File uploads cannot “overtake” avaible space.
• Content is checked for malicious content.
• Application uses a malware scanner (if req.).
• Uploaded HTML files are displayed securely.
• Uploaded files are not moved to a web-accessisble directory.
• Extensive path checks are used when serving files.
• Uploaded files are not served with include().
• Uploaded files are served as an attachment using the Content-Disposition header.
• Application sends the X-Content-Type-Options: nosniff header.
• Files are not served as: (Unless necessary)
• "application/octet-stream"
• "application/unknown"
• "plain/text"

DATABASE

Poin ini adalah bagian yang sangat penting, karena basis data adalah sasaran utama peretas untuk meretas website kalian. Basis data juga merupakan tempat penyimpanan informasi sebuah website. Jadi, kalian tidak boleh melewatkan poin ini.

• Data inserted into the database is properly escaped or parameter/prepared statements are used.
• addslashes() is not used.
• Application does not have more privileges to the database then necessary.
• Remote connections are disabled if they are unnecessary.

SERVING FILE

Website yang melayani servis file harus memperhatikan point ini, agar aman dari user yang tidak memiliki hak akses.

• User input is not directly used in a pathname.
• Directory traversal is prevented.
• Null (\o) in paths are filtered.
• Application is aware of “:”
• PHP streams are filtered.
• Access to files is not restricted by hiding the files.
• Remote files not included with include().

AUTHENTICATION

Website yang membutuhkan sebuah halaman yang hanya dapat diakses oleh user tertentu membutuhkan proses authentication yang sangat ketat, karena itulah poin ini ada untuk pengamanan proses authentication pada website kalian.

• Bad password throttling.
• CAPTCHA is used.
• SSL used to prevent MITM.
• Passwords are not stored in a cookie.
• Passwords are hashed.
• Per-user salts are used.
• crypt() is used with sufficient number of rounds.
• MD5 is not used.
• Users are warned about obvious password recovery questions.
• Account recovery forms do not reveal email existence.
• Pages that send emails are throttled.

Ilustrasi $_SESSION (sumber : www.eslam.me)

SESSIONS

Session digunakan untuk menyimpan data-data penting sebuah website atau user yang sedang login.

• Sessions only use cookies. (session.use_only_cookies)
• On logout, session data is destroyed.
• Session is recreated on authorization level change.
• Sites on the same server use different session storage dirs.

3rd-PARTIES

Keamanan saat mengunakan aplikasi pihak ketiga juga perlu diperhatikan. Berikut ini poin-poin pentingnya.

• CSRF issues are prevented with tokens/keys.
• Referrers are not relied upon.
• Pages that perform actions use POST.
• Important pages (logout, etc.) are protected.
• Your pages are not written in a way (i.e. JSON, JS-like) where they can be included and read on a remote website successfully.
• Aware that Flash can bypass referrer checks to load images and sound files.
• The following things will not reveal significant information if included remotely:
• Images.
• Pages that take a longer time to load.
• CSS files.
• Existence or ordering of frames.
• Existence of a JS variable.
• Detected visit of a URL.
• Inclusion of your website in an inline frame with JS disabled does not reveal a threat.
• Application uses frame bursting code and sends the X-Frame-Options header.

MISCELLANEOUS

• A cryptographically secure PRNG is used for secret randomly-generated IDs (activation links, secret IDs, etc.).
• Suhosin is installed or you are not using rand() or mt_rand() for this.
• Anything that consumes a lot of resources should be throttled and limited.
• Pages that use 3rd-party APIs are throttled.
• You did not create your own encryption algorithm.
• Arguments to external programs (i.e. exec()) are validated.
• Generic internal and external redirect pages are secured.
• Precautions taken against the source code of your PHP pages being shown due to misconfiguration.
• Configuration and critical files are not in a web-accessible directory.

SHARED HOSTING

Shared hosting adalah sebuah hosting yang digunakan oleh banyak website berbeda. Jika misalkan sebuah website pada 1 shared hosting tersebut terkena serangan peretas, maka website kita juga kemungkinan besar akan terkena serangan. Jika website kalian menggunakan shared hosting, maka poin ini sangat penting untuk menjaga kelangsungan hidup website kalian.

• Using a secure shared host where users cannot access the files of other users.
• Aware that fellow shared hosting users:
• Can, if on the same IP address, issue requests against your site with XMLHttpRequest in IE6.
• Can access your website from 127.0.0.1 or ::1.
• Can host a server on the same IP address.
• Are not “remote” as far as your DB is concerned.
• Session & file upload directories are not shared.

Semua poin di atas wajib kalian perhatikan dengan keamanan website kalian. Bagian mana saja yang sudah kalian lakukan? Setelah melihat poin-poin di atas, segeralah benahi website kalian yang belum melakukan security checklist di atas.

Jika kalian ingin membacanya secara offline, kalian bisa mengunduh cheatsheetnya pada link ini. Download PHP Security Cheatsheet

Semoga postingan ini berguna bagi kalian para programmer PHP. Jangan lupa share postingan ini kepada yang membutuhkan. Mari kita memperdalam ilmu bersama-sama. :)

Sumber : github.com, sk89q.com