Where it usually goes wrong
- You copy security code from old projects or forums and hope it still holds up.
- You plan to add protection later, but later never comes.
- Security advice is scattered, so it is hard to know what actually matters.
What to focus on, and how
These are the areas that cause most real world breaches. You do not need to do them all today. Start at the top and work down.
1. Stop untrusted input from running as code
Any text a user sends can turn into a script if you print it back without care. This is called cross site scripting. Escape what you output and add a Content Security Policy as a backstop. See our guides on cross site scripting and Content Security Policy. Learn more at the OWASP XSS Prevention Cheat Sheet and MDN on CSP.
2. Never build database queries by joining strings
Use parameters so user input can never change the shape of your query. This one habit stops most SQL injection. See SQL injection prevention and the OWASP SQL Injection Cheat Sheet.
3. Block actions made in your user's name
Cross site request forgery tricks a logged in user into making a request they did not mean to. Use anti forgery tokens and the SameSite cookie setting. See CSRF explained and the OWASP CSRF Cheat Sheet.
4. Protect the login page
This is the most attacked part of your app. Block stolen and guessed passwords, add limits, and offer a second step at sign in. See rate limiting and lockout, multi factor authentication, and how the attacks differ in brute force vs credential stuffing vs password spraying. Our library OwlAuth gives you breached password blocking and failed attempt tracking out of the box. Background reading: OWASP Authentication Cheat Sheet.
5. Store passwords the right way
Never plain text and never fast hashes like MD5. Use a slow salted hash such as Argon2 or bcrypt, and block passwords that already leaked. See password hashing and breached password checks. Reference: OWASP Password Storage Cheat Sheet.
6. Handle sessions and tokens with care
Set cookies safely, and if you use tokens, make sure you can cancel them when needed. See session management and JWT vs session tokens. Our library OwlTokenGuard handles token creation, rotation, and revocation. Reference: OWASP Session Management Cheat Sheet.
7. Keep secrets out of your code and git history
Load keys and passwords from the environment or a secret manager, never hard code them, and change them from time to time. See secure configuration and secrets, and scan your repo with our free Secret Scanner. Reference: OWASP Secrets Management Cheat Sheet.
8. Serve everything over HTTPS
Turn on TLS and HSTS so traffic cannot be read or changed on the way. See HTTPS and TLS and the Mozilla SSL Configuration Generator.
9. Check that every request is allowed
The top risk on the web today is letting users reach data that is not theirs. Check permissions on the server for every action, not just in the interface. Reference: OWASP: Broken Access Control.
10. Treat file uploads as untrusted
Check the real file type, rename files, and store them away from code that can run. See file upload security and the OWASP File Upload Cheat Sheet.
11. Keep your dependencies fresh
Most of your app is other people's code. Run checks often and update when fixes come out. Reference: npm audit and OWASP: Vulnerable and Outdated Components.
12. Log important actions and watch them
You cannot fix what you cannot see. Record sign ins and sensitive actions, and set alerts. Reference: OWASP: Logging and Monitoring Failures.
13. Think about risks before you build
A short planning step catches problems early and saves rework. See what is threat modeling and STRIDE vs DREAD vs PASTA.
Two ways we help
Learn and check: measure your app with the free OWASP toolkit, and explore the standard step by step in the ASVS Explorer.
Build faster and safer: add OwlAuth and OwlTokenGuard so you are not writing security from scratch.