Application Security

Application Security

What I Do

I provide guidance on securing applications throughout the software development lifecycle. This includes identifying and mitigating common vulnerabilities (OWASP Top 10), implementing secure coding patterns, integrating security testing into CI/CD pipelines, and establishing defense-in-depth strategies that protect applications from injection attacks, broken authentication, data exposure, and other threats.

When to Use Me

• Designing a new application and need security architecture guidance
• Reviewing code for common vulnerability patterns
• Implementing input validation, output encoding, or authentication flows
• Integrating SAST/DAST/SCA tools into your build pipeline
• Remediating findings from a penetration test or vulnerability scan
• Building middleware for security headers, CSRF protection, or rate limiting

Core Concepts

1. OWASP Top 10: The most critical web application security risks including injection, broken authentication, sensitive data exposure, XXE, broken access control, misconfigurations, XSS, insecure deserialization, vulnerable components, and insufficient logging.
2. Input Validation: Verify all input on the server side using allowlists, type checks, length constraints, and range checks before processing.
3. Output Encoding: Context-aware encoding (HTML, JavaScript, URL, CSS) to prevent injection when rendering user-controlled data.
4. Defense in Depth: Layered security controls so that failure of one control does not compromise the entire system.
5. Least Privilege: Grant only the minimum permissions required for a function, user, or process to operate.
6. Secure Session Management: Use strong session IDs, enforce timeouts, regenerate tokens after authentication, and bind sessions to client attributes.
7. Security Headers: HTTP response headers (CSP, HSTS, X-Content-Type-Options, X-Frame-Options) that instruct browsers to enable built-in protections.
8. Dependency Management: Track and update third-party libraries to avoid inheriting known vulnerabilities (CVEs).
9. Error Handling: Return generic error messages to users while logging detailed diagnostics server-side to avoid information leakage.
10. Security Testing Integration: Embed SAST, DAST, and SCA scans in CI/CD to catch vulnerabilities before deployment.

Code Examples

1. Parameterized Queries to Prevent SQL Injection (Python)

import sqlite3
from typing import Optional, Dict, Any

def get_user_by_id(db_path: str, user_id: int) -> Optional[Dict[str, Any]]:
    """Fetch user with parameterized query to prevent SQL injection."""
    conn = sqlite3.connect(db_path)
    conn.row_factory = sqlite3.Row
    cursor = conn.cursor()
    cursor.execute("SELECT id, username, email FROM users WHERE id = ?", (user_id,))
    row = cursor.fetchone()
    conn.close()
    if row:
        return dict(row)
    return None

2. Content Security Policy Middleware (Node.js/Express)

const helmet = require('helmet');

app.use(
  helmet.contentSecurityPolicy({
    directives: {
      defaultSrc: ["'self'"],
      scriptSrc: ["'self'", "'nonce-{{nonce}}'"],
      styleSrc: ["'self'", "'unsafe-inline'"],
      imgSrc: ["'self'", "data:", "https://cdn.example.com"],
      connectSrc: ["'self'", "https://api.example.com"],
      fontSrc: ["'self'"],
      objectSrc: ["'none'"],
      frameAncestors: ["'none'"],
      upgradeInsecureRequests: [],
    },
  })
);

app.use(helmet.hsts({ maxAge: 31536000, includeSubDomains: true, preload: true }));
app.use(helmet.noSniff());
app.use(helmet.frameguard({ action: 'deny' }));

3. CSRF Token Validation (Python/Flask)

import secrets
from functools import wraps
from flask import Flask, session, request, abort

def generate_csrf_token() -> str:
    if "_csrf_token" not in session:
        session["_csrf_token"] = secrets.token_hex(32)
    return session["_csrf_token"]

def csrf_protect(f):
    @wraps(f)
    def decorated(*args, **kwargs):
        if request.method in ("POST", "PUT", "DELETE", "PATCH"):
            token = request.form.get("_csrf_token") or request.headers.get("X-CSRF-Token")
            if not token or token != session.get("_csrf_token"):
                abort(403, description="CSRF token missing or invalid")
        return f(*args, **kwargs)
    return decorated

4. Input Validation with Allowlists (Python)

import re
from typing import Optional

ALLOWED_USERNAME_PATTERN = re.compile(r"^[a-zA-Z0-9_]{3,30}$")
ALLOWED_SORT_FIELDS = {"created_at", "updated_at", "username", "email"}

def validate_username(username: str) -> Optional[str]:
    if not ALLOWED_USERNAME_PATTERN.match(username):
        return None
    return username

def validate_sort_field(field: str) -> str:
    if field not in ALLOWED_SORT_FIELDS:
        return "created_at"
    return field

5. Secure Password Hashing (Python)

import hashlib
import secrets
from typing import Tuple

def hash_password(password: str) -> Tuple[str, str]:
    salt = secrets.token_hex(32)
    pwd_hash = hashlib.pbkdf2_hmac(
        "sha256", password.encode("utf-8"), salt.encode("utf-8"), iterations=600_000
    )
    return pwd_hash.hex(), salt

def verify_password(password: str, stored_hash: str, salt: str) -> bool:
    pwd_hash = hashlib.pbkdf2_hmac(
        "sha256", password.encode("utf-8"), salt.encode("utf-8"), iterations=600_000
    )
    return secrets.compare_digest(pwd_hash.hex(), stored_hash)

Best Practices

1. Validate all input server-side using allowlists and strict type/length/range checks regardless of client-side validation.
2. Use parameterized queries or ORMs for all database interactions to prevent SQL injection.
3. Encode output contextually (HTML, JS, URL, CSS) when rendering user-controlled data.
4. Set security headers (CSP, HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy) on every response.
5. Hash passwords with strong algorithms (bcrypt, scrypt, Argon2, or PBKDF2 with high iteration counts) and unique salts.
6. Implement CSRF protection for all state-changing operations using synchronizer tokens or SameSite cookies.
7. Keep dependencies updated and run SCA scans to detect known vulnerabilities in third-party libraries.
8. Log security events (authentication failures, access denials, input validation failures) with enough context for investigation but without sensitive data.
9. Fail securely by denying access by default when errors occur rather than allowing access.
10. Enforce HTTPS everywhere and redirect HTTP to HTTPS with HSTS headers.