4096 bit RSA key is overkill and slow. 2048 is fine for years
You probably need to support TLS 1.1 for some older clients
Password entropy checks should only be used in a corporate environment. You'll lose customers in a retail environment. You should certainly encourage your customers to use high entropy passwords, but forcing them to will just lose you money.
Login throttling and IP banning is a waste of time. Login throttling will just DoS yourself. You need CAPTCHA or Proof of Work.
Synchronizing Token (CSRF token in hidden form fields) is better than CSRF cookies
Use a real HTML parser (*Soup) to invalidate XSS form input not regex
I see a surprising number of tutorials on blogs recommending 4096bit keys and I do wonder if people know just how much extra load that is. A properly set up HTTPS site with 2048bit certs will be pretty fast - about the same as HTTP and your time will be better spent optimizing other things like images.
For anyone curious about how much slower try "openssl speed rsa2048 rsa4096" for a quick benchmark. The results are ugly.
Comments
4096 bit RSA key is overkill and slow. 2048 is fine for years
You probably need to support TLS 1.1 for some older clients
Password entropy checks should only be used in a corporate environment. You'll lose customers in a retail environment. You should certainly encourage your customers to use high entropy passwords, but forcing them to will just lose you money.
Login throttling and IP banning is a waste of time. Login throttling will just DoS yourself. You need CAPTCHA or Proof of Work.
Synchronizing Token (CSRF token in hidden form fields) is better than CSRF cookies
Use a real HTML parser (*Soup) to invalidate XSS form input not regex
I see a surprising number of tutorials on blogs recommending 4096bit keys and I do wonder if people know just how much extra load that is. A properly set up HTTPS site with 2048bit certs will be pretty fast - about the same as HTTP and your time will be better spent optimizing other things like images.
For anyone curious about how much slower try "openssl speed rsa2048 rsa4096" for a quick benchmark. The results are ugly.
I might be missing something, but I've never come across software having TLS 1.1 support without TLS 1.2.
https://en.wikipedia.org/wiki/Template:TLS/SSL_support_histo...
Plus user agents that aren't browsers