Web Security Fundamentals

Overview

Web security is about protecting your application, its data, and its users from attackers. The two guiding ideas are "never trust user input" and "defense in depth" — assume any input can be malicious and layer multiple protections so one failure does not compromise everything. Most real-world breaches come from a handful of well-understood mistakes, so learning the fundamentals prevents the majority of problems.

Syntax / Usage

Validate and sanitize input on the server, and always encode output for the context it lands in. Client-side checks improve UX but can be bypassed, so the server is the real gatekeeper.

// Never trust the client — re-validate on the server
function createUser(req, res) {
  const { email, age } = req.body;

  if (typeof email !== "string" || !email.includes("@")) {
    return res.status(400).json({ error: "Invalid email" });
  }
  const parsedAge = Number(age);
  if (!Number.isInteger(parsedAge) || parsedAge < 0 || parsedAge > 150) {
    return res.status(400).json({ error: "Invalid age" });
  }

  // Proceed only with validated, well-typed values
  db.users.insert({ email, age: parsedAge });
  res.status(201).json({ ok: true });
}

Examples

Fail closed — deny access by default and only allow what you explicitly permit:

function canAccess(user, resource) {
  if (!user) return false; // default deny
  return resource.ownerId === user.id || user.isAdmin;
}

Use the principle of least privilege for credentials and tokens:

// A read-only report job should not use an admin database account
const reportDb = connect({ user: "reporter", permissions: ["SELECT"] });

Common Mistakes

• Trusting client-side validation and skipping server-side checks
• Exposing detailed error messages or stack traces to users
• Running services or database accounts with more privileges than needed
• Storing secrets (API keys, passwords) in source code or committing .env files
• Assuming "we're too small to be targeted" — automated scanners hit everyone

See Also

web-security-owasp-top-ten web-security-authentication web-security-https-tls