Secure Coding Checklist for Web Developers

A comprehensive baseline for web application security — covering OWASP Top 10, NIST guidelines, and modern full-stack practices (React, Next.js, Flask, Django).

⚡ Minimal Secure Baseline

Copy-paste starting point for every new project. Expand from here.

Passwords:     Argon2id · min 12 chars · HaveIBeenPwned check

Cookies:       httpOnly · Secure · SameSite=Lax

Headers:       Content-Security-Policy (with nonces)
               Strict-Transport-Security (HSTS)
               Referrer-Policy: strict-origin
               X-Content-Type-Options: nosniff
               X-Frame-Options: DENY

CSP baseline:  default-src 'self';
               script-src 'self' 'nonce-{random}';
               object-src 'none';
               base-uri 'self';
               frame-ancestors 'none';

Auth:          Session ID rotation on login
               CSRF tokens (or SameSite=Strict + CORS allowlist)

API:           Rate limiting — per IP, per user, per endpoint
               Server-side validation on every request
               Parameterized queries / ORM only

🔐 Authentication & Sessions

🍪 Cookies & CSRF

🛡️ HTTP Headers & Transport

💉 Input, Output & Injection

🔑 Tokens, Secrets & Cryptography

🗄️ Data, Logging & Infrastructure

📦 Dependencies & Deployment

🔴 Advanced Security Rules — Senior-Level Checklist

These issues appear regularly in real-world security audits but are rarely covered in standard checklists. SSRF is already covered in rule #24 above.

41 · Never Trust the Host Header — Prevent Host Header Attacks

Attackers can manipulate the Host header to poison generated URLs in password reset emails, verification links, and redirects.

Example attack:

Host: attacker.com

Your backend might then generate:

https://attacker.com/reset?token=abc123

Defense: Always use a hardcoded canonical domain when generating URLs. Never derive URLs from request.host.

# Django — enforce an allowlist
ALLOWED_HOSTS = ["example.com", "www.example.com"]

# Flask — never use request.host for URL generation
# Use a hardcoded BASE_URL env variable instead
BASE_URL = os.environ.get("BASE_URL", "https://example.com")

42 · Restrict CORS Strictly — Never Combine Wildcard with Credentials

Never use this combination:

Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true

This allows any website to make authenticated requests to your API using the victim's cookies.

Correct configuration:

For authenticated APIs — allowlist specific origins only:

Access-Control-Allow-Origin: https://app.example.com
Access-Control-Allow-Credentials: true

For fully public APIs with no authentication:

Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: false  (or omit entirely)

43 · Prevent Cache Poisoning on Dynamic Responses

Dynamic responses that depend on authentication or user state must never be cached by shared caches or CDNs. If a proxy caches a personalized response, another user may receive it.

Vulnerable:

Cache-Control: public, max-age=3600

Secure — for authenticated responses:

Cache-Control: no-store

Secure — for semi-dynamic content:

Cache-Control: private, max-age=0

Also validate headers that influence caching behavior — attackers can inject via:

• X-Forwarded-Host
• X-Forwarded-Proto
• Host

44 · Prevent XS-Leaks — Cross-Site Information Leaks

XS-Leaks exploit subtle browser behaviors (timing differences, iframe loading states, redirect detection) to infer private user state across origins — such as whether a user is logged in, whether a resource exists, or the content of a private response.

Mitigation — add cross-origin isolation headers:

Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Resource-Policy: same-origin
Cross-Origin-Embedder-Policy: require-corp

Combined with SameSite cookies, a strict CSP, and frame-ancestors, these headers form a robust isolation boundary.

45 · Validate Redirect Targets — Prevent Open Redirects

Never allow unvalidated redirect URLs from user input. The classic vector:

/login?next=https://evil.com
→ 302 Location: https://evil.com

Attackers abuse open redirects for phishing, OAuth token theft, and bypassing security filters.

Safe redirect logic — allow only relative paths or explicitly whitelisted domains:

from urllib.parse import urlparse

def safe_redirect(url, fallback="/"):
    parsed = urlparse(url)
    # Allow only relative paths (no scheme, no netloc)
    if not parsed.scheme and not parsed.netloc:
        return redirect(url)
    return redirect(fallback)

Never redirect to any URL containing a scheme (http://, https://) unless it is in a hardcoded allowlist.

✅ Quick Reference: Key Upgrades from Common Mistakes

Sources: OWASP Top 10 (2021), NIST SP 800-63B, Password Hashing Competition, CWE/SANS Top 25, PortSwigger Web Security Academy