Web Security Fundamentals

# Web Security Fundamentals Security should be a priority in every web application. Let's explore common vulnerabilities and how to prevent them. ## OWASP Top 10 The most critical web application security risks: 1. Injection (SQL, NoSQL, OS commands) 2. Broken Authentication 3. Sensitive Data Exposure 4. XML External Entities (XXE) 5. Broken Access Control 6. Security Misconfiguration 7. Cross-Site Scripting (XSS) 8. Insecure Deserialization 9. Using Components with Known Vulnerabilities 10. Insufficient Logging & Monitoring ## Preventing SQL Injection Always use parameterized queries: ```javascript // Bad - Vulnerable to SQL injection const query = `SELECT * FROM users WHERE id = ${userId}`; // Good - Using parameterized query const query = db.prepare('SELECT * FROM users WHERE id = ?'); query.bind(userId); ``` ## Preventing XSS Escape user input before rendering: ```javascript function escapeHtml(text) { return text .replace(/&/g, '&') .replace(//g, '>'); } ``` ## Authentication Best Practices - Use HTTPS everywhere - Hash passwords with bcrypt - Implement rate limiting - Use secure session management - Enable two-factor authentication ## CORS Configuration Properly configure Cross-Origin Resource Sharing: ```javascript app.use(cors({ origin: 'https://yourdomain.com', credentials: true })); ``` Security is an ongoing process. Stay updated with the latest threats and best practices.