Web Application Security: Best Practices Every Developer Must Know
Featured Image Placeholder
Add your blog post image here
Introduction
Security breaches cost companies millions and destroy user trust. As developers, we must build security into our applications from day one. This guide covers essential security practices every developer should implement.
OWASP Top 10 Vulnerabilities
1. Broken Access Control
**The Problem:** Users accessing resources they shouldn't.
Prevention:
Example (Node.js):
```javascript
// Bad
app.get('/admin/users', (req, res) => {
// No authorization check!
const users = getAllUsers();
res.json(users);
});
// Good
app.get('/admin/users', requireAuth, requireRole('admin'), (req, res) => {
const users = getAllUsers();
res.json(users);
});
```
2. Cryptographic Failures
**The Problem:** Sensitive data exposure due to weak encryption.
Prevention:
Password Hashing:
```javascript
const bcrypt = require('bcrypt');
const saltRounds = 12;
// Hash password
const hashedPassword = await bcrypt.hash(password, saltRounds);
// Verify password
const isValid = await bcrypt.compare(inputPassword, hashedPassword);
```
3. Injection Attacks
**The Problem:** SQL, NoSQL, Command injection allowing unauthorized access.
Prevention:
SQL Injection Prevention:
```javascript
// BAD - Vulnerable to SQL injection
const query = `SELECT * FROM users WHERE email = '${email}'`;
// GOOD - Parameterized query
const query = 'SELECT * FROM users WHERE email = ?';
db.query(query, [email]);
```
4. Insecure Design
**The Problem:** Architectural flaws in application design.
Prevention:
5. Security Misconfiguration
**The Problem:** Default configurations, unnecessary features enabled.
Prevention:
Essential Security Headers:
```javascript
app.use((req, res, next) => {
res.setHeader('X-Content-Type-Options', 'nosniff');
res.setHeader('X-Frame-Options', 'DENY');
res.setHeader('X-XSS-Protection', '1; mode=block');
res.setHeader('Strict-Transport-Security', 'max-age=31536000');
res.setHeader('Content-Security-Policy', "default-src 'self'");
next();
});
```
6. Vulnerable Components
**The Problem:** Using outdated or vulnerable dependencies.
Prevention:
Automation:
```bash
Check for vulnerabilities
npm audit
npm audit fix
Use Snyk
npx snyk test
npx snyk monitor
```
7. Authentication Failures
**The Problem:** Weak authentication allowing unauthorized access.
Prevention:
Secure Session Management:
```javascript
const session = require('express-session');
app.use(session({
secret: process.env.SESSION_SECRET,
resave: false,
saveUninitialized: false,
cookie: {
secure: true, // HTTPS only
httpOnly: true, // No JavaScript access
maxAge: 3600000, // 1 hour
sameSite: 'strict' // CSRF protection
}
}));
```
8. Software and Data Integrity Failures
**The Problem:** Unsigned updates, insecure CI/CD, deserialization.
Prevention:
9. Security Logging Failures
**The Problem:** Insufficient logging preventing incident detection.
Prevention:
Good Logging Practice:
```javascript
logger.info('User login attempt', {
userId: user.id,
ip: req.ip,
userAgent: req.get('User-Agent'),
success: true,
timestamp: new Date()
});
// Never log:
// - Passwords
// - Credit card numbers
// - Session tokens
// - Personal data
```
10. Server-Side Request Forgery (SSRF)
**The Problem:** Application fetching remote resources without validation.
Prevention:
Additional Security Best Practices
Input Validation
Always validate:
```javascript
const { z } = require('zod');
const userSchema = z.object({
email: z.string().email(),
age: z.number().int().min(13).max(120),
username: z.string().min(3).max(20).regex(/^[a-zA-Z0-9_]+$/)
});
// Validate
const result = userSchema.safeParse(userData);
if (!result.success) {
return res.status(400).json({ errors: result.error });
}
```
XSS Prevention
Cross-Site Scripting prevention:
CSRF Protection
Cross-Site Request Forgery prevention:
```javascript
const csrf = require('csurf');
const csrfProtection = csrf({ cookie: true });
app.post('/transfer', csrfProtection, (req, res) => {
// Protected endpoint
});
```
Rate Limiting
Prevent brute force attacks:
```javascript
const rateLimit = require('express-rate-limit');
const limiter = rateLimit({
windowMs: 15 * 60 * 1000, // 15 minutes
max: 100, // Limit each IP to 100 requests per windowMs
message: 'Too many requests from this IP'
});
app.use('/api/', limiter);
```
File Upload Security
Safe file uploads:
API Security
Secure your APIs:
Security Testing
Automated Tools
Use these tools regularly:
Manual Testing
Regular security reviews:
Security Checklist
Before deploying:
Incident Response Plan
Prepare for breaches:
1. Detection system in place
2. Response team identified
3. Communication plan ready
4. Backup and recovery procedures
5. Legal/regulatory compliance
6. Post-incident review process
Conclusion
Security is not a feature—it's a requirement. Implement these practices from day one, keep learning about new threats, and never assume you're "secure enough."
Key Takeaways
Need a security audit for your application? [Contact our security experts](/contact).