Technical Note
Application Security Practices
Common security vulnerabilities in web applications and how to address them through proper coding practices and infrastructure configuration.
Injection and input validation
Use parameterised queries or an ORM for all database access to avoid SQL injection. Validate and sanitise input on the server; never trust client-supplied data. Apply allowlists for type, format, and length. Encode output correctly for the context (HTML, URL, JavaScript) to reduce XSS.
Authentication and session handling
Store credentials with a strong, adaptive hashing algorithm (e.g. bcrypt, Argon2). Use short-lived, HTTP-only, secure cookies for sessions and rotate IDs on login. Implement rate limiting and lockouts to reduce brute-force and credential-stuffing risk.
Infrastructure and deployment
Run with least privilege: separate roles and restrict IAM and DB permissions. Use HTTPS everywhere and secure headers (CSP, HSTS, etc.). Keep dependencies updated and monitor for known vulnerabilities. Harden the pipeline (build, test, deploy) and avoid secrets in code or logs.