security-standards

Security Standards

Guidelines for writing secure code and avoiding common vulnerabilities.

Core Principles

1. Never trust user input - Validate and sanitize everything
2. Least privilege - Grant minimum necessary permissions
3. Defense in depth - Multiple layers of protection
4. Fail securely - Errors should not expose sensitive data
5. Keep secrets secret - Never commit credentials

Input Validation

Validate All Input

// Bad: Trust user input
const userId = req.params.id;
const user = await db.query(`SELECT * FROM users WHERE id = ${userId}`);

// Good: Validate and parameterize
const userId = parseInt(req.params.id, 10);
if (isNaN(userId) || userId < 0) {
  throw new ValidationError('Invalid user ID');
}
const user = await db.query('SELECT * FROM users WHERE id = $1', [userId]);

Allowlist Over Denylist

// Bad: Trying to block bad input
const sanitized = input.replace(/<script>/gi, '');

// Good: Only allow expected patterns
const ALLOWED_PATTERN = /^[a-zA-Z0-9_-]+$/;
if (!ALLOWED_PATTERN.test(input)) {
  throw new ValidationError('Invalid characters');
}

Type Coercion

// Bad: Loose comparison allows bypass
if (req.body.admin == true) { ... }

// Good: Strict type checking
if (req.body.admin === true && typeof req.body.admin === 'boolean') { ... }

SQL Injection Prevention

Always Use Parameterized Queries

// Bad: String concatenation
db.query(`SELECT * FROM users WHERE email = '${email}'`);

// Good: Parameterized query
db.query('SELECT * FROM users WHERE email = $1', [email]);

// Good: ORM with proper escaping
User.findOne({ where: { email } });

XSS Prevention

Escape Output

// Bad: Direct HTML insertion
element.innerHTML = userComment;

// Good: Text content (auto-escapes)
element.textContent = userComment;

// Good: Sanitize if HTML needed
element.innerHTML = DOMPurify.sanitize(userComment);

React/JSX