Enterprise Client Security Guide

  +  About this document

  +  Communication – https only!

  +  Define dedicated entrance pages

  +  Session-id hijacking

  +  JavaScript Injection, “XSS”

  +  Error output in browser – hiding implementation details

  +  Browser Cache control

  +  Http-header fields that affect security

  +  Resource Access by Class Loader

  +  Internal file access

  +  Embedding a CaptainCasa dialog as IFRAME into other pages

  +  Server-side Script Injection

  +  Special issues