# Webappsec Coding Practices

> Use when building or reviewing web apps, Mozilla WebAppSec auth/sessions, whitelist input, output encoding, CSRF/TLS/CSP, safe uploads, generic errors, and QA checklist verification.

- Skill: `ryan-brosas/webappsec-coding-practices` (Agent Skill)
- Install (CLI): `npx skillmds@latest add ryan-brosas/webappsec-coding-practices`
- Raw SKILL.md: https://api.skillmd.com/api/skills/ryan-brosas/webappsec-coding-practices/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: ryan-brosas (https://skillmd.com/u/ryan-brosas)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/ryan-brosas/webappsec-coding-practices

---


# WebAppSec Secure Coding Practices

Application skill for Mozilla WebAppSec Secure Coding Guidelines + QA checklist ingest (`awesome-guidelines`). General security baseline: `security-and-hardening`. Accessibility overlap: `wcag-accessibility-practices`.

## Core Principle

Secure web apps **validate all request data**, **encode at output boundaries**, **protect sessions on HTTPS**, and **authorize every action on every object**, with generic user errors and QA probes to prove it.

## When to Use / NOT

- Web apps, APIs with browser clients, login/session flows, file uploads.
- PR review on auth, forms, templates, cookies, headers, admin surfaces.

**NOT when:**

- Non-HTTP backend with no web surface, `security-and-hardening` primary.
- WCAG conformance audit, `wcag-accessibility-practices` (pair for CAPTCHA/error UX).
- Pure static markup, `frontend-markup-practices` + this for deployment headers.

## Workflow

1. **Quick wins**, HttpOnly+Secure cookies; HTTPS auth pages; validate all user data.
2. **Auth/session/access**, passwords, sessions, IDOR (`webappsec-auth-session.md`).
3. **Input/output**, whitelist + encoding + parameterized SQL (`webappsec-input-output.md`).
4. **Cross-domain/transport**, CSRF, framing, TLS, CSP (`webappsec-cross-domain-transport.md`).
5. **Uploads/errors/verify**, files, errors, QA checklist (`webappsec-uploads-errors-verify.md`).

## Red Flags

- Cookie missing Secure or HttpOnly
- Login or authenticated assets over HTTP / mixed content
- Username enumeration on login or password reset
- Weak password hashing (md5/sha1) without migration
- Session ID not rotated on login
- Authorization only in UI or only by action type
- Blocklist input validation; client-only validation
- SQL string concatenation with user input
- Unencoded user data in HTML/JS templates
- State-changing POST without CSRF token
- Remote third-party script without update review
- Missing X-Frame-Options on HTML
- Inline JS blocking CSP adoption
- User-controlled upload filename or path
- Wrong Content-Type on user uploads
- Stack traces or SQL errors shown to users
- DEBUG enabled in production

## Verification

- Mozilla QA checklist probes on changed endpoints (input, SQLi, XSS, CSRF, X-Frame)
- Cookie and session flag inspection
- HTTPS-only auth flow crawl
- Parameterized query audit on changed data access
- Template/output encoding review
- Upload test cases (extension spoof, archive size)
- Pair with `npm audit`/dependency check from `security-and-hardening`


## References

- `awesome-guidelines/references/webappsec-style-learning-note.md`
- `awesome-guidelines/references/webappsec-auth-session.md`
- `awesome-guidelines/references/webappsec-input-output.md`
- `awesome-guidelines/references/webappsec-cross-domain-transport.md`
- `awesome-guidelines/references/webappsec-uploads-errors-verify.md`

## Related skills

- `security-and-hardening`, OWASP, secrets, dependencies, headers
- `wcag-accessibility-practices`, accessible error messages and forms
- `json-api-practices`, API contract security adjacent to CSRF/CORS