Cheat sheet · Back end and data
Web security cheat sheet
The common web attacks, a one-line defence for each, and the headers and habits that stop most of them.
- Sections
- 4
- Items
- 22
- Area
- Back end and data
- Download
- PNG, PDF
Cheat sheet
Web security
The common web attacks, a one-line defence for each, and the headers and habits that stop most of them.
Top risks and the fix
Broken access control- Check permission on the server for every request, by default deny
Injection (SQL, command)- Use parameterised queries; never join user text into a command
Cross-site scripting (XSS)- Escape output; use a Content-Security-Policy; do not insert raw HTML
Cross-site request forgery (CSRF)- SameSite cookies and anti-forgery tokens for changing actions
Cryptographic failures- HTTPS everywhere; strong password hashing; no home-made crypto
Security misconfiguration- Turn off debug and defaults; give the least access needed
Vulnerable components- Keep packages updated; run npm audit or a scanner in CI
Server-side request forgery (SSRF)- Do not fetch addresses from users, or allow only a fixed list
Logging gaps- Log sign-ins and failures; alert on odd patterns; never log secrets
Passwords and sessions
bcrypt / argon2- Hash passwords with a slow, salted algorithm
Cookie: HttpOnly; Secure; SameSite- Cookie flags for a session
Short-lived tokens + refresh- Limit the damage if a token leaks
Multi-factor sign-in- Stops most stolen-password attacks
Rate limit sign-in- Slows guessing
Security headers
Content-Security-Policy- Which scripts, images and frames the page may load
Strict-Transport-Security- Browser must use HTTPS for this site
X-Content-Type-Options: nosniff- Do not guess file types
frame-ancestors 'none' (or X-Frame-Options)- Stop other sites putting yours in a frame
Referrer-Policy: strict-origin-when-cross-origin- Send less address data to other sites
Habits
Validate on the server- Browser checks are for comfort, not safety
Secrets in environment variables- Never in code or in git
Least privilege- Each person, key and service gets only what it needs
Remember
- Never put a secret in a front end bundle or a NEXT_PUBLIC_ variable. Anyone can read it.
- The OWASP Top 10 list is a good public checklist to review before every launch.
Learn it properly
A cheat sheet helps you remember. These lessons explain the ideas step by step, with examples.