Requests, files and caches

Required

• Fetch only allowed addresses

  APS-41

  When the server fetches an address a user gave, allow only the hosts it needs. Never reach internal or cloud metadata addresses.

• Check every uploaded file

  APS-43

  Accept only the file types you need, check them by content, limit their size, and store them where they cannot run.

• Keep file paths inside their folder

  APS-44

  Never build a file path from user input without proving the result stays inside the allowed folder.

• Keep private pages out of shared caches

  APS-46

  Mark every reply that depends on the logged-in user Cache-Control: private, and never let a CDN cache by file extension alone.

Recommended

• Treat data from other APIs as untrusted

  APS-42

  Check and limit what comes back from partner and third-party APIs, as you would for user input.

• Unpack archives safely

  APS-45

  Keep every entry of an uploaded zip or tar file inside the target folder, and stop unpacking at a fixed total size and file count.

• Keep unkeyed headers from changing cached pages

  APS-47

  Let a cached reply depend only on the parts of the request in the cache key. Never build a cached page from a header the cache ignores.

• Make every server agree where a request ends

  APS-48

  Refuse every request whose length is unclear, so a proxy and the app behind it never read one request as two.