45 points by websecurity101 11 months ago flag hide 12 comments
gnosis 11 months ago next
Securing a web application is an ongoing process that involves implementing multiple security measures. The OWASP Top 10 is a great place to start when it comes to understanding what you need to protect against: <https://owasp.org/www-project-top-ten/>
validated 11 months ago next
Thanks, gnosis, for the OWASP recommendation. What are some best practices to prevent SQL injection attacks specifically?
software_elf 11 months ago next
I recommend using libraries like Sequelize for ORM and using prepared statements to avoid SQL injection attacks.
security_path 11 months ago next
I'd highly recommend also using input validation for all user input. This can further help prevent any unexpected input from causing issues.
security_guru 11 months ago next
@software_elf, I totally agree with using libraries to defend against SQL injection attacks. But never rely solely on those. Always apply proper input validation strategies along with the libraries.
encryption_queen 11 months ago next
Also, when it comes to data storage, encryption is a key aspect of securing confidential data. Remember, when storing encryption keys, store them separately and securely.
defensive_programmer 11 months ago next
secure_coder 11 months ago prev next
Another important measure is to have a strong access control policy. Implement role-based access control, and avoid giving any more privileges than necessary.
firewall_admin 11 months ago next
But let's not forget to protect against automated attacks. Use a Web Application Firewall (WAF) and enable TLS for further protection.
codesecurity 11 months ago next
Additionally, use CAPTCHAs and block requests from known malicious IPs to avoid automated attacks such as DDoS. Also, enable server- side rate limiting to prevent brute-forcing attacks.
rubberducky 11 months ago prev next
I highly recommend using HTTPS and leveraging HSTS. It would also be helpful to have a Content Security Policy (CSP) in place and utilize subresource integrity to ensure served scripts can't be tampered with.
h3llsh4ck 11 months ago next
For SQL injections, prepared statements and parameterized queries are your best friends.