The web application security checklist we run before every launch

Authentication and session management

1. 1Passwords hashed with bcrypt, scrypt or Argon2 at current parameters — never a raw hash function.
2. 2Session tokens in HttpOnly, Secure, SameSite cookies, never in localStorage.
3. 3Session id rotated on login and invalidated on password change and logout.
4. 4Rate limiting and lockout on login, password reset and any credential endpoint.
5. 5Identical responses whether or not an account exists, on login and reset.
6. 6Multi-factor authentication available, and required for administrative accounts.
7. 7Password reset tokens single-use, short-lived and stored hashed.

Authorisation — the one most teams get wrong

Every request must be checked against the current user's permissions at the point the data is accessed, not in the UI or in middleware alone.

// Vulnerable: any authenticated user can read any invoice
const invoice = await db.invoice.findUnique({ where: { id } });

// Correct: ownership is part of the query
const invoice = await db.invoice.findFirst({
  where: { id, organisationId: session.organisationId },
});
if (!invoice) notFound();   // do not reveal that it exists

• Check ownership on every read and every mutation, including nested resources.
• Never accept a role, price, permission or tenant id from the client.
• Test with two accounts: can user A reach user B's records by changing an id?
• Return 404 rather than 403 where the existence of a record is itself sensitive.
• Apply the same checks to API routes, server actions and background jobs.

Input, output and injection

1. 1Validate every input against a schema on the server. Client validation is UX only.
2. 2Use parameterised queries or an ORM — never string-concatenate SQL.
3. 3Escape output by context. React escapes by default; dangerouslySetInnerHTML does not.
4. 4Sanitise any HTML you must render, with an allow-list library, on the server.
5. 5Validate and constrain redirects to an allow-list — open redirects enable phishing.
6. 6Validate outbound URLs against SSRF: block internal ranges and cloud metadata endpoints.
7. 7Verify file uploads by content, not extension, and re-encode images.

Transport, headers and configuration

• HTTPS everywhere with HSTS, HTTP redirected permanently.
• Content-Security-Policy, X-Content-Type-Options, Referrer-Policy and a restrictive Permissions-Policy.
• CORS restricted to known origins — never a wildcard with credentials.
• Debug modes, verbose errors and source maps disabled in production.
• Admin interfaces not exposed on a guessable path without authentication.
• Default credentials changed everywhere, including databases and admin tools.

Dependencies, secrets and monitoring

1. 1Automated dependency scanning with a policy for how quickly criticals get patched.
2. 2Lockfiles committed; builds reproducible.
3. 3Secrets in a manager, injected at runtime, rotated on a schedule, never committed.
4. 4Secret scanning with push protection on the repository.
5. 5Audit logging of authentication events, permission changes and administrative actions.
6. 6Alerting on repeated authentication failures and unusual access patterns.
7. 7A documented process for reporting and handling a vulnerability disclosure.