Prerequisites & Discovery Inputs
Have the following assets, repositories, and architectural context accessible before executing this evaluation:
- Application configuration files and routes
- CORS, CSP, and SSL configurations
- Overview of access control implementations
Problem Statement
Web platforms are subject to constant security attacks. Developers often implement security controls in an ad-hoc manner, leaving gaps in areas like session management, data exposure, and input sanitization. This checklist provides an actionable audit format based on industry security principles (OWASP Top 10) to secure production applications.
When to Use
Use this checklist during pre-release security reviews, before launching new public API endpoints, or when performing routine security health checks.
Step-by-Step Guide
Step 1: Input and Output Handling
- Validate all incoming HTTP payloads against strict JSON schemas or strict data types.
- Ensure all user-supplied data is HTML-escaped before rendering in templates.
- Enforce parameterized database queries or ORM models to prevent SQL injection.
Step 2: Authentication and AuthZ Boundaries
- Enforce HTTPS and restrict cookies to Secure, HttpOnly, and SameSite=Lax.
- Implement rate-limiting at the reverse proxy or API gateway layer.
- Verify role-based or attribute-based access controls are validated on the server side for every request.
Step 3: Dependencies and Runtime Environment
- Scan dependencies for known security vulnerabilities (CVEs) during the CI/CD pipeline.
- Audit CORS configurations and Content Security Policies (CSP) to restrict untrusted scripts.
- Ensure all secrets, credentials, and API keys are stored in secure environment variables or vault systems, never in source code.
Checklist Items
- Parameterized queries are used for all database queries to prevent SQL injections.
- Session cookies utilize Secure, HttpOnly, and SameSite attributes.
- API endpoints have strict rate-limiting configuration active at the network boundary.
- Content Security Policy (CSP) headers are configured to block unauthorized third-party scripts.
- Sensitive user data is encrypted at rest and masked in application log outputs.
- Automated dependency scanners (e.g., Dependabot, Snyk) run on every pull request.
- Server headers are stripped of software versions and infrastructure details (e.g., X-Powered-By).
- Role-based access controls (RBAC) are verified on the server side, not just in UI menus.
Architectural Invariant · Production Hardening
Architecture specifications are only as sound as their verification in running production. In high-throughput systems, ensure every interface boundary maintains isolated timeout budgets, automated fallback circuits, and zero reliance on unmetered external dependencies.
Frequently Asked Questions
Practical insights on security executionHow does edge rate-limiting improve security?
It blocks automated brute-force attacks and denial-of-service attempts before they hit application servers, preserving operational uptime.