Web Security

Web Security — Professional Standards

Mindset

Every input is hostile until proven otherwise. Every privilege is a liability until proven necessary. The average breach goes undetected for 200+ days — not because attacks are sophisticated, but because code assumed the caller was trustworthy.

Security is not a feature added at the end. It is a design constraint applied from the first line.

---

OWASP Top 10 — 2025 Edition

Apply these as a mental checklist on every feature you build or review.

A01 — Broken Access Control (#1 most exploited)

The most common and most damaging class of web vulnerability.

Rules:

• Every endpoint must verify the caller has permission for the specific resource — not just that they're logged in
• Deny by default: if there's no explicit allow, the answer is deny
• Never expose internal IDs directly — use opaque tokens or UUIDs, not sequential integers (IDOR prevention)
• Check authorization server-side on every request — never trust client-side state or hidden form fields
• Validate CORS: Access-Control-Allow-Origin: * is only acceptable for truly public, read-only data
• File path inputs must be sanitized — validate against a whitelist and use path.resolve() + check prefix

IDOR pattern to enforce:

// Wrong — trusts caller owns the resource
GET /api/orders/1234

// Right — verify ownership server-side
const order = await getOrder(orderId)
if (order.userId !== req.user.id) return 403

A02 — Cryptographic Failures

Rules:

• HTTPS everywhere — no exceptions, including internal APIs
• Never store passwords in plaintext or with reversible encryption — use bcrypt, Argon2, or scrypt
• Never use MD5 or SHA-1 for security purposes — use SHA-256 minimum, SHA-512 preferred
• Secrets (API keys, tokens, passwords) never go in source code — use environment variables or secrets managers
• Sensitive data at rest must be encrypted — user PII, payment data, health records
• Session tokens must be cryptographically random — minimum 128 bits of entropy
• Never log sensitive data: passwords, tokens, credit card numbers, SSNs, health info