Security: a Sunflower principle

This is a freely-licensed creative work called a standard. It sets the tone for how Sunflower software developers should build code that users can reasonably trust.

This document can change; just open a Pull Request on GitLab if you have that ability.

This document is supposed to standardize websites and web apps. Standards for a secure way of developing apps in your favorite framework could be coming soon.

Always use HTTPS.

Sunflower websites are always to be served over HTTPS. This should go without saying, but we might update this section and add some resources below.

Web apps should not (attempt to) be zero-trust.

See FantasyCookie17’s post on how web apps can’t pretend to be zero-trust. Websites are rather hard to get right, but have the potential to be entire sandboxed applications fitting right into the OS’s permission model. Listen up.

Don’t use outside resources. Period.

Don’t use resources outside of the ones you can statically host.This not only opens the gate to Cross Site Scripting (XSS) , but such a request would need to be end-to-end-encrypted, and that’s trying to be something we’re not: zero trust.

Use JavaScript very sparingly.

Use JavaScript in such a way that it progressively enhances the experience of those who don’t disable it.