🔒

[SAMPLE] Security Checklist for Web Developers

6 months ago

	Category	Item	Priority	Description	Status
1	Authentication	Strong passwords	Critical	Enforce minimum 12 characters with mixed character types	Required
2	Authentication	Multi-factor authentication	Critical	Implement TOTP or WebAuthn for all user accounts	Required
3	Authentication	Rate limiting on login	Critical	Limit login attempts to prevent brute-force attacks	Required
4	Authentication	Secure session management	High	Use HttpOnly and Secure flags on session cookies	Required
5	Authentication	Password hashing	Critical	Use bcrypt or Argon2 -- never store plaintext passwords	Required
6	Input Validation	Server-side validation	Critical	Validate and sanitize all user input on the server	Required
7	Input Validation	Parameterized queries	Critical	Use parameterized queries or ORM to prevent SQL injection	Required
8	Input Validation	Output encoding	High	Encode output to prevent XSS attacks	Required
9	Input Validation	File upload restrictions	High	Validate file type and size and store outside web root	Recommended
10	Transport	HTTPS everywhere	Critical	Enforce TLS for all connections including internal services	Required
11	Transport	HSTS header	High	Set Strict-Transport-Security header to prevent downgrade attacks	Required
12	Transport	Certificate management	High	Automate certificate renewal with Lets Encrypt or similar	Required
13	Headers	Content Security Policy	High	Define CSP to prevent XSS and data injection	Recommended
14	Headers	X-Frame-Options	Medium	Set to DENY or SAMEORIGIN to prevent clickjacking	Recommended
15	Headers	X-Content-Type-Options	Medium	Set to nosniff to prevent MIME type confusion	Recommended
16	Headers	Referrer-Policy	Low	Control referrer information sent with requests	Optional
17	API Security	API rate limiting	High	Implement rate limiting per user and per endpoint	Required
18	API Security	CORS configuration	High	Restrict allowed origins to known domains only	Required
19	API Security	API key rotation	Medium	Rotate API keys regularly and support multiple active keys	Recommended
20	API Security	JWT best practices	High	Short expiry times and use refresh tokens with rotation	Required
21	Dependencies	Dependency scanning	High	Use Dependabot or Snyk to monitor for vulnerabilities	Recommended
22	Dependencies	Lock files	Medium	Commit lock files to ensure reproducible builds	Required
23	Monitoring	Security logging	High	Log authentication events and access anomalies	Required
24	Monitoring	Error handling	Medium	Never expose stack traces or internal details to users	Required

全24件

Comments

sakura_suzuki

Posts

Followers

Likes

Properties

Table

LIST

Remote WorkWeb DevelopmentPCDocker

November 15, 2024

Audrey TangLarry Page

English