Security best practices

Secure Programming Best Practices

Actionable security checklists by OWASP Top 10 (2021) category; each item links to the relevant OWASP Cheat Sheet.

How to Use

1. Identify the categories relevant to the code being written or reviewed
2. Walk their checklist items below
3. Consult the reference index below for relevant ASVS chapters and cheat sheets by topic
4. Search local references — Grep references/ for keywords, ASVS IDs (V1, V1.2, V1.2.4), or topic terms. Never read entire files — read only matching sections with context (30–50 lines)
5. Use the search_standards MCP tool (if available) for standards beyond local references
6. Fetch OWASP cheat sheets for implementation detail when local references aren't enough — fetch the linked URL for every relevant checklist item
7. For framework-specific guidance, see Framework-Specific Security and read or fetch the corresponding cheat sheet
8. Always include OWASP cheat sheet URLs and ASVS requirement IDs in output

Local Reference Index

ASVS 5.0 — references/OWASP_Application_Security_Verification_Standard_5.0.0_en.csv CSV columns: chapter_id,chapter_name,section_id,section_name,req_id,req_description,level (L1=basic, L2=standard, L3=advanced)

ID	Chapter	Key sections
V1	Encoding and Sanitization	V1.1 Architecture, V1.2 Injection Prevention, V1.3 Sanitization, V1.4 Memory, V1.5 Safe Deserialization
V2	Validation and Business Logic	V2.2 Input Validation, V2.3 Business Logic, V2.4 Anti-automation
V3	Web Frontend Security	V3.2 Content Interpretation, V3.3 Cookie Setup, V3.4 Browser Headers, V3.5 Origin Separation, V3.6 Resource Integrity
V4	API and Web Service	V4.1 Generic Web Service, V4.2 HTTP Message Validation, V4.3 GraphQL, V4.4 WebSocket
V5	File Handling	V5.2 Upload and Content, V5.3 Storage, V5.4 Download
V6	Authentication	V6.2 Password, V6.3 General Auth, V6.4 Factor Lifecycle, V6.5 MFA, V6.6 Out-of-Band, V6.7 Cryptographic, V6.8 IdP
V7	Session Management	V7.2 Fundamental, V7.3 Timeout, V7.4 Termination, V7.5 Session Abuse, V7.6 Federated Re-auth
V8	Authorization	V8.2 General Design, V8.3 Operation Level, V8.4 Other
V9	Self-contained Tokens	V9.1 Source and Integrity, V9.2 Content
V10	OAuth and OIDC	V10.1 Generic, V10.2 Client, V10.3 Resource Server, V10.4 Auth Server, V10.5 OIDC Client, V10.6 OpenID Provider
V11	Cryptography	V11.2 Implementation, V11.3 Algorithms, V11.4 Hashing, V11.5 Random Values, V11.6 Public Key, V11.7 In-Use Data
V12	Secure Communication	V12.1 TLS Guidance, V12.2 HTTPS External, V12.3 Service-to-Service
V13	Configuration	V13.2 Backend Communication, V13.3 Secret Management, V13.4 Information Leakage
V14	Data Protection	V14.2 General, V14.3 Client-side
V15	Secure Coding and Architecture	V15.2 Dependencies, V15.3 Defensive Coding, V15.4 Concurrency
V16	Security Logging and Error Handling	V16.2 General Logging, V16.3 Security Events, V16.4 Log Protection, V16.5 Error Handling
V17	WebRTC	V17.1 TURN Server, V17.2 Media, V17.3 Signaling

Cheat Sheets (109 files) — references/cheatsheets/<Topic>_Cheat_Sheet.md

Category	Topics (filename prefixes)
Access Control	Access_Control, Authorization, Authorization_Testing_Automation, Insecure_Direct_Object_Reference_Prevention, Multi_Tenant_Security, Transaction_Authorization
Authentication	Authentication, Credential_Stuffing_Prevention, Forgot_Password, Multifactor_Authentication, Password_Storage, Choosing_and_Using_Security_Questions, SAML_Security, OAuth2, JAAS
Sessions and Cookies	Session_Management, Cookie_Theft_Mitigation
Tokens	JSON_Web_Token_for_Java
Injection	Input_Validation, SQL_Injection_Prevention, Query_Parameterization, OS_Command_Injection_Defense, LDAP_Injection_Prevention, Injection_Prevention, Injection_Prevention_in_Java, NoSQL_Security
XSS and Frontend	Cross_Site_Scripting_Prevention, DOM_based_XSS_Prevention, DOM_Clobbering_Prevention, Content_Security_Policy, Prototype_Pollution_Prevention, XSS_Filter_Evasion, XS_Leaks, Clickjacking_Defense, Securing_Cascading_Style_Sheets, HTML5_Security, AJAX_Security, Browser_Extension_Vulnerabilities
CSRF and SSRF	Cross-Site_Request_Forgery_Prevention, Server_Side_Request_Forgery_Prevention, Unvalidated_Redirects_and_Forwards
Cryptography and TLS	Cryptographic_Storage, Key_Management, Transport_Layer_Security, Transport_Layer_Protection, TLS_Cipher_String, HTTP_Strict_Transport_Security, Pinning
API Security	REST_Security, REST_Assessment, GraphQL, gRPC_Security, WebSocket_Security, Web_Service_Security
Data Integrity	Deserialization, Mass_Assignment, File_Upload, Bean_Validation
Secrets and Config	Secrets_Management, HTTP_Headers, PHP_Configuration, Database_Security
Logging and Errors	Logging, Logging_Vocabulary, Error_Handling
Infrastructure	Docker_Security, Kubernetes_Security, Infrastructure_as_Code_Security, CI_CD_Security, Network_Segmentation, Secure_Cloud_Architecture, Serverless_FaaS_Security, Zero_Trust_Architecture
Supply Chain	Vulnerable_Dependency_Management, Dependency_Graph_SBOM, NPM_Security, Software_Supply_Chain_Security, Third_Party_Javascript_Management
AI and LLM	AI_Agent_Security, LLM_Prompt_Injection_Prevention, Secure_AI_Model_Ops
Design and Architecture	Threat_Modeling, Abuse_Case, Attack_Surface_Analysis, Secure_Product_Design, Secure_Code_Review, Legacy_Application_Management, Virtual_Patching, Vulnerability_Disclosure, User_Privacy_Protection, Denial_of_Service
Mobile and IoT	Mobile_Application_Security, Automotive_Security, Drone_Security
Frameworks	Django_Security, Django_REST_Framework, Laravel, Symfony, Ruby_on_Rails, Nodejs_Security, NodeJS_Docker, DotNet_Security, Java_Security, C-Based_Toolchain_Hardening
Payments and Microservices	Third_Party_Payment_Gateway_Integration, Microservices_Security, Microservices_based_Security_Arch_Doc

Language-Specific Security Patterns — references/<language>-security-patterns.md

File	Covers
python-security-patterns.md	Injection, deserialization, SSRF, supply chain, XML/XXE, async
rust-security-patterns.md	Unsafe soundness, FFI, async/concurrency, supply chain, archive traversal
go-security-patterns.md	Parsing footguns, concurrency, SSRF, template injection, supply chain
typescript-security-patterns.md	Prototype pollution, XSS/DOM, SSRF, supply chain, type coercion

Each file includes language-specific security scanner recommendations.

---

A01: Broken Access Control

• Deny access by default; require explicit grants (Access Control)
• Enforce authorization server-side; never rely on client-side checks (Authorization)
• Use indirect object references or validate ownership before returning resources (IDOR Prevention)
• Apply rate limiting and account lockout to prevent brute-force
• Log all access control failures and alert on repeated attempts
• Invalidate sessions and tokens on logout and password change (Session Management)
• Validate CORS configuration; avoid Access-Control-Allow-Origin: * for authenticated endpoints (HTTP Headers)
• For multi-tenant systems, enforce tenant isolation at every data access layer (Multi-Tenant Security)

A02: Cryptographic Failures

• Use TLS 1.2+ for all data in transit; disable older protocols (TLS)
• Enable HSTS with includeSubDomains and adequate max-age (HSTS)
• Use strong, modern algorithms (AES-256-GCM, ChaCha20-Poly1305); avoid DES, RC4, MD5, SHA-1 (Cryptographic Storage)
• Store passwords with Argon2id, bcrypt, or scrypt — never plain hashes (Password Storage)
• Manage secrets through a vault or environment variables; never hardcode (Secrets Management)
• Rotate keys on a defined schedule; support key versioning (Key Management)

A03: Injection

• Validate all input: type, length, range, format; use allowlists over denylists (Input Validation)
• Use parameterized queries or prepared statements for all SQL (SQL Injection Prevention, Query Parameterization)
• Context-escape all output: HTML-encode for HTML, JS-encode for JavaScript, URL-encode for URLs (XSS Prevention, DOM-based XSS Prevention)
• Avoid OS command execution; if unavoidable, use strict allowlists and no shell interpolation (OS Command Injection Defense)
• Sanitize LDAP input using established escape functions (LDAP Injection Prevention)
• Deploy Content Security Policy to mitigate XSS impact (CSP)
• Prevent DOM clobbering by avoiding document.getElementById on user-controllable IDs (DOM Clobbering Prevention)
• Guard against prototype pollution in JavaScript by freezing prototypes or using Object.create(null) (Prototype Pollution Prevention)

A04: Insecure Design

• Perform threat modeling early in the design phase (Threat Modeling)
• Identify and document abuse cases alongside use cases (Abuse Case)
• Analyze and minimize the attack surface for each feature (Attack Surface Analysis)
• Follow secure product design principles: least privilege, defense in depth, fail secure (Secure Product Design)

A05: Security Misconfiguration

• Disable unnecessary features, ports, services, and default accounts
• Harden Docker containers: non-root user, read-only filesystem, minimal base image (Docker Security)
• Apply Kubernetes security best practices: pod security policies, network policies, RBAC (Kubernetes Security)
• Scan IaC templates for misconfigurations before deployment (IaC Security)
• Disable XML external entity processing in all XML parsers (XXE Prevention)
• Set security headers: X-Content-Type-Options, X-Frame-Options, Referrer-Policy, etc. (HTTP Headers)
• Secure CI/CD pipelines: least-privilege tokens, signed artifacts, audit logs (CI/CD Security)

A06: Vulnerable and Outdated Components

• Maintain an inventory of all dependencies and their versions (Dependency Graph / SBOM)
• Continuously scan dependencies for known vulnerabilities (Vulnerable Dependency Management)
• Audit third-party JavaScript for integrity and behavior (Third Party JS Management)
• Use lockfiles and verify package integrity hashes (NPM Security)
• Review supply chain security practices for critical dependencies (Software Supply Chain Security)

A07: Identification and Authentication Failures

• Enforce minimum password complexity and check against breached password lists (Authentication)
• Implement MFA for privileged and sensitive operations (MFA)
• Generate session IDs server-side with high entropy; regenerate after authentication (Session Management)
• Secure password reset flows: time-limited tokens, side-channel verification (Forgot Password)
• Prevent credential stuffing with rate limiting, CAPTCHA, and device fingerprinting (Credential Stuffing Prevention)
• Implement OAuth 2.0 with PKCE for public clients (OAuth 2.0)
• Set cookie attributes: Secure, HttpOnly, SameSite, proper Path and Domain (Cookie Theft Mitigation)

A08: Software and Data Integrity Failures

• Never deserialize untrusted data; if required, validate schema and use safe libraries (Deserialization)
• Protect against mass assignment: explicitly allowlist assignable fields (Mass Assignment)
• Validate file uploads: check type via magic bytes (not just extension or Content-Type header), enforce size limits, re-encode/re-process content to strip metadata and neutralize polyglots; store outside webroot with random names. Explicitly reject dangerous types: SVG (can contain embedded JavaScript), HTML, executables (.exe, .sh, .bat), server-side scripts (.php, .jsp). (File Upload)
• Verify integrity of software artifacts with checksums and signatures

A09: Security Logging and Monitoring Failures

• Log authentication events, access control failures, input validation failures, and application errors (Logging)
• Use consistent log format and vocabulary for automated analysis (Logging Vocabulary)
• Never log sensitive data: passwords, tokens, PII, credit card numbers
• Return generic error messages to users; log detailed errors server-side (Error Handling)
• Set up alerts for anomalous patterns: brute force, privilege escalation, unusual data access

A10: Server-Side Request Forgery (SSRF)

• Validate and sanitize all user-supplied URLs (SSRF Prevention)
• Use allowlists for permitted domains and protocols
• Block requests to internal/private IP ranges (127.0.0.0/8, 10.0.0.0/8, 169.254.0.0/16, etc.)
• Disable unnecessary URL schemes (file://, gopher://, ftp://)
• Run server-side HTTP clients in network-restricted environments when possible

---

API Security

• Authenticate and authorize every API request (REST Security)
• Validate request content types and reject unexpected media types
• Apply rate limiting and request size limits
• For GraphQL: limit query depth and complexity; disable introspection in production (GraphQL)
• For gRPC: use TLS, validate protobuf messages, implement interceptor-based auth (gRPC Security)
• For WebSockets: validate origin, authenticate the handshake, validate all messages (WebSocket Security)
• Prevent CSRF with synchronizer tokens or SameSite cookies (CSRF Prevention)
• Validate redirect URLs against an allowlist (Unvalidated Redirects)

AI and LLM Security

• Validate and sanitize all LLM inputs and outputs (LLM Prompt Injection Prevention)
• Apply least privilege to AI agent tool access and actions (AI Agent Security)
• Secure model serving infrastructure: access controls, input limits, monitoring (Secure AI Model Ops)

Framework-Specific Security

When working with a specific framework, consult its cheat sheet for framework-specific pitfalls and mitigations:

Framework	Cheat Sheet
Django	Django Security, Django REST Framework
Laravel	Laravel
Symfony	Symfony
Ruby on Rails	Ruby on Rails
Node.js	Node.js Security, Node.js Docker
.NET	.NET Security
Java	Java Security, Injection Prevention in Java
C/C++	C-Based Toolchain Hardening

Additional References

For topics not covered above, browse the full OWASP Cheat Sheet Series Index.