Web application security

Peppers

Like salts, but global to the application. Don't bother with these, because:

• They provide limited extra 'security'
• You can't easily rotate the pepper as it is effectively embedded in password hashes etc.

Articles

• Yummy cookies across domains
• The Basics of Web Application Security
• Web Storage: the lesser evil for session tokens
• HTTP cookies, or how not to design protocols
• It's all about time