Security Considerations for Building a Web Application

Enforce access control server-side on every request — never trust client-side checks alone
Follow principle of least privilege
Guard against IDOR (Insecure Direct Object Reference) — verify the requesting user actually owns/can access the resource, not just that they're authenticated
SSRF (Server-Side Request Forgery): validate/allowlist any URLs your server fetches on a user's behalf (webhooks, "import from URL," image proxies) so an attacker can't make your backend hit internal services
Re-check authorization on every request, not just at the UI/routing layer

Use strong password hashing (bcrypt, Argon2, scrypt) — never plaintext or fast hashes like MD5/SHA1
Enforce MFA where possible, especially for sensitive accounts
Use secure, random session tokens; rotate on privilege changes (e.g., login)
Set cookies with HttpOnly, Secure, and SameSite attributes
Proper session expiration and server-side logout (not just client-side)
Rate-limit login attempts to prevent brute-forcing

SQL Injection: parameterized queries / prepared statements only
XSS: context-aware output encoding; frameworks that auto-escape by default; enforce a Content Security Policy (CSP)
Command Injection: avoid shelling out with user input; use safe APIs and strict allowlists
XXE / insecure deserialization: restrict external entities and untrusted object formats
Validate everything server-side (client-side validation is UX, not security)

Keep dependencies patched; monitor CVEs (npm audit, Dependabot, Snyk)
Vet third-party packages before adding them; watch for typosquatted/malicious packages
Pin dependencies by hash, not just version; use lockfiles
Secure your CI/CD pipeline — restrict who can push to registries, verify build artifact integrity, use signed commits/builds where possible

Design for failure, not just success — define what happens on timeouts, unexpected input, or resource exhaustion
Never let an exception cause an auth check to "fail open" (silently pass)
Disable verbose stack traces/error messages in production — they leak internals
Test edge cases and abnormal conditions, not just happy paths, for both crashes and security bypasses

Encrypt sensitive data at rest and in transit (TLS everywhere — HTTPS only, HSTS)
Never log sensitive data (passwords, tokens, PII) in plaintext
Practice data minimization — only collect/store what's needed
Secure key/secrets management — no hardcoded secrets in code or repos; use a secrets manager

Set security headers: CSP, X-Content-Type-Options, X-Frame-Options/CSP frame-ancestors (clickjacking protection), Referrer-Policy
Harden server configs — close unused ports, disable directory listing, remove default accounts
Segment environments (dev/staging/prod); restrict prod access

Validate file type, size, and actual content (not just extension)
Store uploads outside the web root or in isolated storage (e.g., S3) with restricted execution permissions
Scan for malware on arbitrary uploads

Log security-relevant events (failed logins, permission changes) without logging sensitive data
Pair logs with active alerting — a log nobody watches doesn't stop an attack in progress
Have an incident response plan

Review AI-generated code for injection flaws, hardcoded secrets, and insecure defaults — don't merge it on trust

# edited with sonnet 5