Security And Compliance

• Skim the OWASP Top 10 categories. Learn what each roughly means and how it shows up in APIs.
• Map trust boundaries in your service: client, API, DB, third‑party APIs, queues.
• Identify data classifications in your app: PII, secrets, public.

• Add strict validation and canonicalization on every external input (path, query, headers, body).
• Use parameterized queries or safe ORMs for all database access.
• Return clear 4xx errors when validation fails.

• Load secrets from environment or a secrets manager, never from code or git history.
• Scope secrets with least privilege (per‑service, per‑env). Rotate regularly.
• Add deny‑by‑default config if a secret is missing.

• Serve only HTTPS, enforce HSTS, and disable weak ciphers.
• Use modern hashing (bcrypt/argon2) for passwords.
• If you must encrypt fields, use authenticated encryption (e.g., AES‑GCM) with managed keys.

• Define clear roles and permissions. Apply least privilege.
• Centralize authorization checks; fail closed.
• Write unit tests for critical permission paths.

• Emit structured logs for security‑relevant events (auth, permission checks, data exports, config changes).
• Mask secrets in logs; avoid storing raw PII where not needed.
• Set retention and access controls for logs.

• Enable security headers, rate limits, timeouts, and request size limits.
• Harden dependencies; pin versions; enable automatic updates where safe.
• Run regular dependency and container scans; patch quickly.

• Minimize collection; prefer pseudonymized identifiers.
• Set and document retention; delete on schedule.
• Provide ways to export or delete user data when required by policy.

// Bad: string interpolation (vulnerable)
// const rows = await db.query(`SELECT * FROM users WHERE email = '${email}'`);

// Good: parameterized query
const { Client } = require('pg');
const client = new Client();
await client.connect();

async function findUserByEmail(email) {
  const res = await client.query(
    'SELECT id, email FROM users WHERE email = $1',
    [email]
  );
  return res.rows[0] || null;
}

Why it works: the driver sends data separately from the query plan, so attacker input cannot alter SQL structure.

from passlib.hash import bcrypt

# Hashing during signup
hashed = bcrypt.hash(plain_password)  # auto-salt, configurable rounds

# Verifying during login
if bcrypt.verify(input_password, hashed):
    authenticate_user()
else:
    deny()

Notes: never store plaintext or reversible encryption. Tune cost factor to your performance budget.

const express = require('express');
const helmet = require('helmet');
const app = express();

app.enable('trust proxy'); // if behind a proxy/load balancer
app.use(helmet());
app.use(helmet.hsts({ maxAge: 31536000, includeSubDomains: true, preload: false }));

// Redirect HTTP to HTTPS if needed
app.use((req, res, next) => {
  if (req.secure) return next();
  return res.redirect(301, `https://${req.headers.host}${req.url}`);
});

HSTS tells browsers to always use HTTPS for your domain, preventing downgrade attacks.

const crypto = require('crypto');

function encryptField(plaintext, key32) {
  const iv = crypto.randomBytes(12);
  const cipher = crypto.createCipheriv('aes-256-gcm', key32, iv);
  const ciphertext = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()]);
  const tag = cipher.getAuthTag();
  return { iv: iv.toString('base64'), ct: ciphertext.toString('base64'), tag: tag.toString('base64') };
}

function decryptField(bundle, key32) {
  const iv = Buffer.from(bundle.iv, 'base64');
  const ct = Buffer.from(bundle.ct, 'base64');
  const tag = Buffer.from(bundle.tag, 'base64');
  const decipher = crypto.createDecipheriv('aes-256-gcm', key32, iv);
  decipher.setAuthTag(tag);
  const plaintext = Buffer.concat([decipher.update(ct), decipher.final()]).toString('utf8');
  return plaintext;
}

// Key management: load from a secure source, rotate on schedule.
const key32 = crypto.randomBytes(32); // example only

Use authenticated encryption (GCM) to detect tampering. Never hardcode keys; load securely and rotate.

const permissions = {
  admin: ['user:read', 'user:write', 'export:pii'],
  manager: ['user:read'],
  user: []
};

function allow(requiredPerm) {
  return (req, res, next) => {
    const role = req.user?.role || 'user';
    const allowed = permissions[role]?.includes(requiredPerm);
    if (!allowed) return res.status(403).json({ error: 'forbidden' });
    next();
  };
}

// Example usage: app.get('/admin/export', auth, allow('export:pii'), handler)

Keep authorization centralized and testable. Default to deny.

function auditLog({ actorId, action, resource, result, ip, meta }) {
  const entry = {
    ts: new Date().toISOString(),
    actorId,
    action,
    resource,
    result, // success | deny | error
    ip,
    meta
  };
  console.log(JSON.stringify({ type: 'audit', ...entry }));
}

// Example: auditLog({ actorId: 'u_123', action: 'login', resource: 'self', result: 'success', ip: '203.0.113.7' })

Never log secrets. Limit PII; use pseudonymous IDs where possible. Control access to logs.

Frontends are untrusted. Always validate on the server. Tip: add server tests for invalid payloads.

SHA‑256/MD5 are fast and unsafe for passwords. Use bcrypt/Argon2 with a reasonable cost. Verify performance under load.

Secrets in code or git last forever. Load from environment or a secrets manager. Deny start if missing.

Do not invent algorithms. Use vetted libraries, modern modes (AEAD), and standard key sizes.

Fail closed. If a permission check is unsure, deny. Cover critical paths with tests.

Mask or avoid PII in logs. If you must include an identifier, prefer pseudonymous IDs; set retention.

• Validation on all inputs (title length, allowed chars, size limits).
• Auth: session or token with RBAC (user vs admin). Admin can list all notes; users only their own.
• Parameterized DB queries.
• HTTPS only with HSTS (or reverse proxy enforcing it in local env).
• Audit logs for create, read (own), read (admin), update, delete.
• Secrets from environment; app refuses to start if missing.
• Optional: encrypt note content at rest with AES‑GCM.
• Privacy: do not log note content; mask tokens in logs. Add a retention config for logs.

• Invalid payloads return 400 with clear error messages.
• Unauthorized requests return 401; forbidden actions return 403.
• SQL injection attempts fail and are logged without leaking stack traces.
• Security headers include HSTS and sensible defaults.
• Secrets never appear in logs; missing secrets block startup.
• Audit log shows who did what, when, and the result.

Outcome: You can recognize common web risks (Top 10), sketch threat models, and name typical mitigations.

Estimated time: 45–60 min

Outcome: You can validate and canonicalize inputs, avoid injection, and return safe errors.

Estimated time: 45–90 min

Outcome: You can load secrets securely, avoid hardcoding, rotate credentials, and scope permissions.

Estimated time: 45–75 min

Outcome: You can enforce HTTPS/HSTS and use authenticated encryption (e.g., AES‑GCM) for sensitive fields.

Estimated time: 60–120 min

Outcome: You can design roles/scopes, centralize checks, and test deny/allow paths.

Estimated time: 60–120 min

Outcome: You can produce structured, privacy‑aware audit logs with retention controls.

Estimated time: 45–90 min

Outcome: You can enable security headers, rate limits, timeouts, and dependency scanning.

Estimated time: 60–120 min

Outcome: You can minimize collection, mask data, set retention, and support deletion/export workflows.

Estimated time: 60–120 min