Security

Security

OWASP Top 10 (2021) — Quick Reference

#	Category	What to check
A01	Broken Access Control	Is authorization enforced on every endpoint?
A02	Cryptographic Failures	Are secrets encrypted at rest and in transit?
A03	Injection	Is all input sanitized or parameterized?
A04	Insecure Design	Is the threat model documented?
A05	Security Misconfiguration	Are defaults changed? Debug off in prod?
A06	Vulnerable Components	Are dependencies up to date?
A07	Auth & Session Failures	Are sessions invalidated on logout? Token expiry set?
A08	Software Integrity Failures	Are supply-chain dependencies verified?
A09	Logging & Monitoring Failures	Are security events logged without leaking PII?
A10	SSRF	Are outbound URLs allowlisted?

Input Validation

Validate all input at system boundaries. Never trust data from: HTTP request body, query parameters, headers, cookies, or environment variables passed by external systems.

Rules:

• Validate type, format, length, and range
• Reject unknown fields — do not silently ignore them
• Use allowlists (accept known-good), not blocklists (reject known-bad)
• Validate at the API layer before it reaches the service layer

// Spring Boot — Bean Validation
data class CreateUserRequest(
    @field:NotBlank @field:Email val email: String,
    @field:Size(min = 8, max = 72) val password: String,
    @field:Size(max = 100) val name: String
)

@PostMapping
fun createUser(@Valid @RequestBody request: CreateUserRequest): ResponseEntity<UserResponse> {
    // request is guaranteed valid here
}

# Django REST Framework — serializer validation
class CreateUserSerializer(serializers.Serializer):
    email = serializers.EmailField(max_length=254)
    password = serializers.CharField(min_length=8, max_length=72, write_only=True)
    name = serializers.CharField(max_length=100)

    def validate_email(self, value):
        if User.objects.filter(email=value).exists():
            raise serializers.ValidationError("Email already registered.")
        return value.lower()

// Next.js / Astro — Zod
import { z } from 'zod';

const CreateUserSchema = z.object({
  email: z.string().email().max(254),
  password: z.string().min(8).max(72),
  name: z.string().max(100),
});

const result = CreateUserSchema.safeParse(body);
if (!result.success) {
  return Response.json({ error: result.error.flatten() }, { status: 400 });
}

Authentication

JWT (Stateless)

Use JWTs for stateless API authentication. Keep access tokens short-lived.

Token lifetimes:

Token	Lifetime	Storage
Access token	15 minutes	Memory (never localStorage)
Refresh token	7–30 days	HttpOnly cookie

Never store access tokens in localStorage — XSS can read them. Store in memory (React state, module variable) and refresh via the HttpOnly cookie.

// Spring Security 6 + JWT
@Configuration
@EnableWebSecurity
class SecurityConfig(private val jwtFilter: JwtAuthenticationFilter) {

    @Bean
    fun filterChain(http: HttpSecurity): SecurityFilterChain = http
        .csrf { it.disable() }                         // stateless API — CSRF not needed
        .sessionManagement { it.sessionCreationPolicy(SessionCreationPolicy.STATELESS) }
        .authorizeHttpRequests { auth ->
            auth
                .requestMatchers("/api/auth/**").permitAll()
                .requestMatchers("/api/admin/**").hasRole("ADMIN")
                .anyRequest().authenticated()
        }
        .addFilterBefore(jwtFilter, UsernamePasswordAuthenticationFilter::class.java)
        .build()
}

# Django — djangorestframework-simplejwt
# settings.py
SIMPLE_JWT = {
    "ACCESS_TOKEN_LIFETIME": timedelta(minutes=15),
    "REFRESH_TOKEN_LIFETIME": timedelta(days=7),
    "ROTATE_REFRESH_TOKENS": True,
    "BLACKLIST_AFTER_ROTATION": True,
    "ALGORITHM": "HS256",
    "AUTH_HEADER_TYPES": ("Bearer",),
}

// Next.js — Auth.js (NextAuth v5)
// auth.ts
import NextAuth from 'next-auth';
import Credentials from 'next-auth/providers/credentials';

export const { auth, signIn, signOut } = NextAuth({
  providers: [
    Credentials({
      authorize: async (credentials) => {
        // validate and return user or null
      },
    }),
  ],
  session: { strategy: 'jwt', maxAge: 7 * 24 * 60 * 60 },
});

Password Hashing

Never store plaintext passwords. Never use MD5 or SHA-1 for password hashing.

Algorithm	Use	Work factor
bcrypt	default	cost=12
Argon2id	preferred when available	m=65536, t=3
PBKDF2	FIPS environments	iterations=600000

// Spring Security uses bcrypt by default
@Bean
fun passwordEncoder(): PasswordEncoder = BCryptPasswordEncoder(12)

# Django uses PBKDF2 by default; switch to Argon2 for stronger hashing
# pip install django[argon2]
PASSWORD_HASHERS = [
    "django.contrib.auth.hashers.Argon2PasswordHasher",
    "django.contrib.auth.hashers.PBKDF2PasswordHasher",  # fallback for existing hashes
]

Authorization

Principle of least privilege: every endpoint must explicitly declare who can access it. Deny by default.

// Spring — method-level security
@PreAuthorize("hasRole('ADMIN') or #userId == authentication.name")
fun getUser(userId: String): UserResponse { ... }

# Django REST Framework
class UserDetailView(RetrieveUpdateAPIView):
    permission_classes = [IsAuthenticated, IsOwnerOrAdmin]
    queryset = User.objects.all()

class IsOwnerOrAdmin(BasePermission):
    def has_object_permission(self, request, view, obj):
        return request.user.is_staff or obj == request.user

Always check authorization at the object level, not just the endpoint level. An authenticated user should not be able to access another user's data by changing an ID in the URL.

CORS

// Spring Boot — explicit allowlist; never use "*" in production
@Bean
fun corsConfigurationSource(): CorsConfigurationSource {
    val config = CorsConfiguration().apply {
        allowedOrigins = listOf("https://app.example.com")
        allowedMethods = listOf("GET", "POST", "PUT", "DELETE")
        allowedHeaders = listOf("Authorization", "Content-Type")
        allowCredentials = true
        maxAge = 3600L
    }
    return UrlBasedCorsConfigurationSource().apply {
        registerCorsConfiguration("/api/**", config)
    }
}

# Django — django-cors-headers
CORS_ALLOWED_ORIGINS = [
    "https://app.example.com",
]
CORS_ALLOW_CREDENTIALS = True
CORS_ALLOW_ALL_ORIGINS = False  # never True in production

Security Headers

Set these headers on every response. They defend against XSS, clickjacking, and MIME sniffing.

Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: camera=(), microphone=(), geolocation=()

// Next.js — next.config.ts
const securityHeaders = [
  { key: 'X-Frame-Options', value: 'DENY' },
  { key: 'X-Content-Type-Options', value: 'nosniff' },
  { key: 'Referrer-Policy', value: 'strict-origin-when-cross-origin' },
  {
    key: 'Strict-Transport-Security',
    value: 'max-age=63072000; includeSubDomains; preload',
  },
];

export default {
  headers: async () => [
    { source: '/(.*)', headers: securityHeaders },
  ],
};

Secrets Management

Never commit secrets to source control. No exceptions.

✗ DATABASE_URL = "postgres://user:password@prod.example.com/db"  # in source
✓ DATABASE_URL = env("DATABASE_URL")                              # from environment

Rules:

• Load secrets from environment variables or a secrets manager (AWS Secrets Manager, Vault, GCP Secret Manager)
• Rotate credentials on any suspected exposure
• Use separate credentials per environment (dev, staging, prod)
• Add .env to .gitignore and never commit it

# Django — django-environ
import environ
env = environ.Env()
environ.Env.read_env()  # reads .env in development only

SECRET_KEY = env("SECRET_KEY")
DATABASE_URL = env.db("DATABASE_URL")

Rate Limiting

Protect authentication endpoints. Brute-force without rate limiting can compromise any account with a weak password.

// Spring Boot — Bucket4j
@Component
class RateLimitFilter(private val rateLimiter: RateLimiter) : OncePerRequestFilter() {

    override fun doFilterInternal(request: HttpServletRequest, response: HttpServletResponse, chain: FilterChain) {
        if (request.requestURI.startsWith("/api/auth/")) {
            val probe = rateLimiter.tryConsumeAndReturnRemaining(1)
            if (!probe.isConsumed) {
                response.status = HttpStatus.TOO_MANY_REQUESTS.value()
                return
            }
        }
        chain.doFilter(request, response)
    }
}

Minimum rate limits for auth endpoints: 5 requests per minute per IP. Stricter limits (e.g., 3 per 15 minutes) are better for login endpoints.

SQL Injection Prevention

Never concatenate user input into SQL strings. Always use parameterized queries or an ORM.

// bad — SQL injection risk
val user = jdbcTemplate.queryForObject("SELECT * FROM users WHERE email = '$email'")

// good — parameterized
val user = jdbcTemplate.queryForObject(
    "SELECT * FROM users WHERE email = ?",
    UserRowMapper(),
    email
)

# bad
User.objects.raw(f"SELECT * FROM users WHERE email = '{email}'")

# good — Django ORM handles parameterization automatically
User.objects.filter(email=email)

Logging Security Events

Log authentication events without including sensitive data.

Log:   login success/failure, permission denied, password reset, token refresh
Never: passwords, tokens, PII (full email in prod logs), credit card numbers

// Log security events at INFO level; failures at WARN
log.info("Authentication successful for user={}", userId)
log.warn("Authentication failed: invalid credentials for user={}", maskedEmail)
log.warn("Authorization denied: user={} attempted access to resource={}", userId, resourceId)