web-security-checklist

Web Security Checklist

A fast, concrete checklist for reviewing and hardening web applications. Read the relevant section for the change at hand rather than the whole file. Treat each unchecked box as a question to answer, not a box to tick blindly.

Rationalizations (read first)

Pre-written rebuttals to the excuses that precede a skipped control. If you catch yourself thinking the left column, the right column is the answer.

Rationalization	Rebuttal
"This endpoint is internal, no auth needed."	"Internal" is a network assumption, not a guarantee. Authn + authz still apply.
"It's just an MVP, we'll harden later."	Auth, secrets, and injection are table stakes, not later-work. Later rarely comes.
"Input comes from our own frontend."	The frontend is not a trust boundary. The API is. Validate at the boundary.
"It's behind a login, so it's safe."	Authn ≠ authz. IDOR lives exactly here — check owner/role on every resource.
"The framework auto-escapes output."	Verify the sink. dangerouslySetInnerHTML, raw SQL, and template bypasses exist.

Threat modeling (start here)

Before picking defenses, spend five minutes thinking like an attacker:

• Trust boundaries mapped (requests, file uploads, webhooks, third-party APIs, LLM output).
• Sensitive assets identified (credentials, PII, payment data, admin actions, financial transactions).
• STRIDE pass per boundary (Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege).
• Abuse cases written next to use cases: "how could I misuse this?"

Pre-commit

• No secrets in the diff (git diff --cached | grep -iE "password|secret|api_key|token").
• .gitignore covers .env, .env.local, *.pem, *.key.
• .env.example uses placeholder values only (no real secrets).

Authentication

• Passwords hashed with bcrypt (≥12 rounds), scrypt, or argon2.
• Session cookies set httpOnly, secure, sameSite: 'lax'.
• Session lifetime bounded (reasonable max-age).
• Rate limiting on the login endpoint (e.g. ≤10 attempts / 15 min).
• Password reset tokens time-bounded (≤1 hour) and single-use.
• Account lockout after repeated failures (optional, with user notice).
• MFA available for sensitive operations (recommended).