Web Apps Security / Performance

Web Apps Security and Performance.md

Security

The Security Checklist

General

• Throttle failed logins (password, token, email link, ...)
• Notify the old address on email change
• Check and Automate - https://gist.github.com/halilim/7888069
• Change admin path

Passwordless Auth

• Expire the link after a short amount of time
• The link should only be one-time (e.g. usable only once)

Links

• Signing in to Medium by email

PHP

• http://www.sk89q.com/2009/08/definitive-php-security-checklist/

---

Performance

PHP

• Opcode caching (OPcache, APC etc)
• Develop your code against E_STRICT. If the code you are hosting have many notices, deprecation warnings, strict warnings etc your app might have to spend a long time for writing logs. Either fix the code or lower the error level in php.ini

MySQL

• innodb_buffer_pool_size, (under [mysqld] in /etc/my.cnf)
• http://www.mysqlperformanceblog.com/2006/09/29/what-to-tune-in-mysql-server-after-installation/
• http://www.mysqlperformanceblog.com/2008/09/16/when-is-it-a-time-to-upgrade-memory/

Ruby

• Fast Ruby

---

... to be continued ...