Securing a web application: a checklist that actually ships
Most breaches are not exotic. They are a missing access check, an old dependency, a leaked key or a SQL string built by hand. Close those and you have done most of the work.
Authentication
- Hash passwords with bcrypt or argon2. Rate-limit login and password reset.
- Session cookies
httpOnly,secure,SameSite. Rotate on privilege change.
Authorisation
Check permission on every request, server-side, against the resource owner — not just "is logged in". Hiding a button is not access control.
Input and output
- Parameterised queries everywhere. No string-built SQL.
- Validate and type-coerce every input at the boundary. Escape on output; set a Content-Security-Policy.
- Lock down file uploads by type and size; serve them from a path that enforces an ownership check.
Supply chain and secrets
Automated dependency scanning in CI. Secrets in a manager or environment, never in the repo. Least-privilege database and cloud credentials.
Observability
Log auth events and admin actions. Alert on spikes in 4xx/5xx and on new error signatures. You cannot respond to what you cannot see.