Web Application Security: Practical Defenses for Product Teams
Security is not a penetration test the week before launch. This article covers auth, input validation, headers, and secrets — the baseline every Paradise Code project implements.
Ali Mortazavi
Founder, Paradise Code
Threat Model for Typical Web Products
Most product teams face credential stuffing, IDOR on APIs, XSS in rich text, CSRF on state-changing forms, and leaked secrets in repos. Start with those vectors before exotic attack research.
Identify assets: user PII, payment data, admin actions, API keys. Identify trust boundaries: browser, CDN, app server, database, third parties. Defenses attach to boundaries.
Security requirements should appear in user stories for auth, file upload, and admin features — not as a surprise gate before release.
Authentication and Session Management
Hash passwords with bcrypt or Argon2; never store plaintext. Enforce MFA for admin and high-risk accounts.
Use HTTP-only, Secure, SameSite cookies for session tokens where architecture allows. For SPA plus API, short-lived JWTs and refresh rotation with reuse detection reduce stolen token impact.
Implement account lockout or backoff on failed logins. Log auth events for anomaly detection.
Input, Output, and Headers
Validate and sanitize all input server-side. Client validation is UX only. Parameterized queries or ORM prevent SQL injection; strict schemas prevent NoSQL operator injection.
Encode output in HTML contexts. Use a vetted sanitizer for rich text. CSP headers reduce XSS blast radius when mistakes happen.
Set security headers: HSTS, X-Content-Type-Options, frame ancestors policy, Referrer-Policy. Many frameworks and platforms apply defaults — verify they are enabled in production.
Secrets, Dependencies, and Supply Chain
Secrets in environment variables or a vault, rotated on schedule. Scan repos with gitleaks in CI. Preview deployments must not inherit production secrets unnecessarily.
Keep dependencies updated; automate npm audit or Dependabot review. Pin major versions and test upgrades in staging.
Minimize third-party scripts on authenticated pages. Each script is a supply chain risk and a performance cost.
Incident Readiness
Logging without secrets: who did what, when, from which IP — for auth and admin. Retention aligned with compliance needs.
A simple incident runbook: revoke tokens, rotate keys, notify users if required, postmortem without blame.
Web application security is layered defaults plus disciplined reviews. Paradise Code treats OWASP Top 10 mitigations as part of definition of done, not optional hardening.
Insights
Need these ideas implemented in your product?
Paradise Code supports you from consult to full delivery.