security

Security Best Practices

This skill provides security best practices, OWASP Top 10 guidance, and secure coding patterns applicable across multiple programming languages.

OWASP Top 10 (2021)

1. Broken Access Control

Problem: Users can access resources they shouldn't have access to.

Solutions:

• Implement proper authentication and authorization
• Validate user permissions on every request
• Use principle of least privilege
• Validate ownership before allowing access

// ✅ Good: Check authorization
export async function getOrder(req: Request, res: Response) {
  const order = await orderService.getById(req.params.id);
  
  if (order.userId !== req.user.id) {
    return res.status(403).json({ error: 'Forbidden' });
  }
  
  res.json(order);
}

2. Cryptographic Failures

Problem: Sensitive data exposed due to weak encryption or missing encryption.

Solutions:

• Encrypt sensitive data at rest and in transit
• Use strong, up-to-date cryptographic algorithms
• Never store passwords in plain text (use hashing)
• Use HTTPS/TLS for all communications

// ✅ Good: Hash passwords
import bcrypt from 'bcrypt';

const hashedPassword = await bcrypt.hash(password, 10);

// ✅ Good: Verify passwords
const isValid = await bcrypt.compare(inputPassword, hashedPassword);

3. Injection

Problem: Untrusted data is sent to interpreter (SQL, NoSQL, OS, LDAP).

Solutions:

• Use parameterized queries/prepared statements
• Validate and sanitize all input
• Use ORMs with built-in protection
• Escape special characters

// ❌ Bad: SQL Injection vulnerability
const query = `SELECT * FROM users WHERE id = ${userId}`;

// ✅ Good: Parameterized query
const query = 'SELECT * FROM users WHERE id = $1';
const result = await db.query(query, [userId]);

// ✅ Good: Parameterized query in C#
var query = "SELECT * FROM Users WHERE Id = @id";
var result = await connection.QueryAsync<User>(query, new { id = userId });