Which secure coding best practice says to require authentication before allowing any files to be uploaded and to limit the types of files to only…

The best practice described involves controlling who can upload files (authentication) and what types of files can be uploaded (file type validation). These are core principles of secure File management. This practice aims to prevent vulnerabilities such as Unrestricted File Upload (CWE-434), where an attacker could upload a malicious file (e.g., a web shell) to execute arbitrary code on the server. By enforcing authentication and strict file type controls, the application ensures that file operations are performed securely and within authorized parameters.

B. Communication security: This practice focuses on protecting data in transit, typically using encryption like TLS/SSL, not on application-level logic for handling file uploads.

C. Data protection: This is a broad category. While secure file management is a component of data protection, "File management" is the more specific and accurate answer for these particular controls.

D. Memory management: This concerns the secure allocation and deallocation of memory to prevent vulnerabilities like buffer overflows and is unrelated to file upload authentication or type validation.

---

1. OWASP Foundation, "File Upload Cheat Sheet." OWASP, a widely respected source in software security, explicitly lists countermeasures for secure file uploads. Under the "Application-level Configuration" section, it recommends to "Check for authenticated and authorized users" and under "File Content-based validation," it details methods to "Validate the file type." This directly aligns with the practices mentioned in the question as part of secure file handling.

Source: OWASP File Upload Cheat Sheet, owasp.org/www-community/vulnerabilities/UnrestrictedFileUpload

2. Carnegie Mellon University, Software Engineering Institute, "CERT C Secure Coding Standard." The CERT standards provide authoritative guidelines for secure coding. The principle of validating all inputs is a cornerstone. Specifically, rule FIO42-C ("Close files when they are no longer needed") is part of the "FIO: File I/O" section, which covers the secure management of file operations. The controls in the question are an application of input validation and access control principles to file I/O.

Source: CERT C Secure Coding Standard, Rule FIO42-C and general principles of the FIO section.

3. MIT OpenCourseWare, "6.858 Computer Systems Security, Fall 2014." University courseware from reputable institutions like MIT emphasizes fundamental security principles. Lecture 1 discusses threat modeling and core security principles like access control. Requiring authentication before a file upload is a direct implementation of the principle of least privilege and access control, which are fundamental to securely managing system resources, including files.

Source: MIT OCW, 6.858 Computer Systems Security, Fall 2014, Lecture 1: "Threat models and security principles." (ocw.mit.edu)