Important validations during HTTP request/response

Question

What are the important Validations/Processing which can be done during the http request/response to protect web application from vulnerablities like cross site scripting cross site request forgery and any other security attacks?

Answer 1

There are tons of books on the topic which essentially boil down to garbage in, garbage out. Things to consider:

1. Validate all input for malicious markup
2. Escape strings before they go into a processing system like an SQL server
3. Don't allow any vector for server or client side code injection eval() overuse
4. Bind sessions to IP addresses to catch session hijacking
5. Use SSL if required and ensure users are aware of the risks
6. Limit attempts on passwords, and don't indirectly expose information ie "We have your username, but the password is incorrect"
7. Use signed cookies
8. Only include source from trusted and verifiable third parties
9. Use "I am human" verification such as a Captcha
10. Be aware of spiders crawling through your site

The list goes on and on, and for every new technology you get more things to consider. Bottom line, have a security attitude that looks at things like an attacker would. How would you crack your own site? If you can't answer that, you need help from somone who can or read some books.