Web Security Checklist: Comprehensive Security Guide

OWASP Top 10

1. Broken Access Control: Missing authorization controls. Users can access resources they are not authorized for.

2. Cryptographic Failures: Sensitive data not encrypted or weak encryption used.

3. Injection: SQL, NoSQL, OS, LDAP injection. When user input is directly added to query.

4. Insecure Design: Design with security vulnerabilities. No threat modeling done.

5. Security Misconfiguration: Default settings, open debug mode, missing security headers.

6. Vulnerable Components: Third-party libraries with security vulnerabilities. Outdated dependencies.

7. Authentication Failures: Weak password policy, session management errors, no brute force protection.

8. Software and Data Integrity Failures: CI/CD pipeline security, dependency integrity, insecure deserialization.

9. Security Logging Failures: Insufficient logging, no monitoring, no incident response plan.

10. SSRF (Server-Side Request Forgery): Server makes request to URL controlled by attacker.

Security Headers

CSP adds protection; unsafe-inline can weaken it. Use nonces or hashes for required scripts.

Strict-Transport-Security (HSTS): Tells browser to only connect via HTTPS. max-age=31536000; includeSubDomains; preload.

X-Content-Type-Options: nosniff value disables MIME type sniffing.

X-Frame-Options: DENY or SAMEORIGIN. Prevents page from being displayed in iframe (clickjacking).

Referrer-Policy: strict-origin-when-cross-origin. Controls referrer information.

Permissions-Policy: Controls browser features like camera, microphone, geolocation.

Authentication and Authorization

Password policy: Minimum 8 characters, uppercase/lowercase, number, special character. Password hashing (bcrypt, Argon2).

Multi-factor authentication (MFA): Mandatory 2FA or MFA. TOTP (Google Authenticator), SMS, hardware key (YubiKey).

Session management: Secure, HttpOnly, SameSite cookies. Session timeout, concurrent session limit.

JWT: Short-lived access token (15 min) + long-lived refresh token (7 days). Token rotation.

OAuth 2.0 / OpenID Connect: Third-party authentication. Login with Google, GitHub, Apple.

RBAC: Role-Based Access Control. User roles and permissions. Least privilege principle.

Input Validation and Sanitization

Server-side validation: Validate all inputs on server side. Client-side validation is not sufficient.

SQL injection prevention: Use parameterized queries / prepared statements. ORMs (Prisma, SQLAlchemy) provide automatic protection.

XSS prevention: Output encoding. React/Vue automatic escaping. textContent instead of innerHTML.

CSRF prevention: CSRF tokens. SameSite cookie attribute. Double submit cookie pattern.

File upload security: File type and size control. Don't give execution permission in upload directory. Virus scanning.

Security Monitoring and Response

Logging: Log all authentication, authorization, and error events. Centralized logging (ELK, Loki).

Monitoring: Anomaly detection. Failed login attempts, unusual traffic patterns, error rate spikes.

Incident response plan: Plan how to respond to security incidents. Runbooks, escalation paths.

Vulnerability scanning: Regular security scanning. OWASP ZAP, Burp Suite, Snyk.

Penetration testing: Professional penetration test at least once a year. Findings report and remediation plan.

Security Checklist

✓ HTTPS active on all pages

✓ Security headers (CSP, HSTS, X-Content-Type-Options, X-Frame-Options) configured

✓ Input validation applied on all endpoints

✓ SQL injection protection (parameterized queries)

✓ XSS protection (output encoding, CSP)

✓ CSRF protection (tokens, SameSite cookies)

✓ Authentication (MFA, strong password policy)

✓ Authorization (RBAC, least privilege)

✓ Dependency security (npm audit, Snyk)

✓ Logging and monitoring active

✓ Backup and disaster recovery plan

✓ Incident response plan

• MDN: Content Security Policy