Web Security Essentials Every Developer Must Know

Security is a Feature, Not an Afterthought

Security vulnerabilities are embarrassing, expensive, and sometimes catastrophic. The good news: the most common vulnerabilities are entirely preventable with basic hygiene.

The OWASP Top 10

OWASP publishes the ten most critical web application security risks. Here are the ones most relevant to modern developers:

1. SQL Injection

Never interpolate user input into SQL queries. Always use parameterized queries:

// DANGEROUS
const user = await db.query(
  `SELECT * FROM users WHERE email = '${email}'`
);

// SAFE
const user = await db.query(
  "SELECT * FROM users WHERE email = $1",
  [email]
);

2. Cross-Site Scripting (XSS)

Sanitize any user-generated content before rendering it as HTML. Modern frameworks like React escape output by default — but dangerouslySetInnerHTML bypasses this protection.

3. Broken Authentication

Common mistakes to avoid:

• Storing passwords in plaintext (use bcrypt, argon2, or scrypt)
• Weak session tokens (use cryptographically random values)
• No rate limiting on login endpoints (enables brute force)
• Long session lifetimes with no refresh

Security Headers

Set these HTTP headers on every response:

Content-Security-Policy: default-src 'self'
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000; includeSubDomains

Secrets Management

Never commit secrets to git. Use environment variables, and consider a secrets manager (AWS Secrets Manager, HashiCorp Vault) for production. If you accidentally commit a secret, rotate it immediately — assume it's compromised.

Dependency Security

Run npm audit regularly and keep dependencies up to date. Subscribe to security advisories for packages you use. Consider tools like Snyk or GitHub Dependabot to automate this.