Building Secure Web Applications: A Practical Checklist

Building a secure web application is no longer a luxury reserved for banking systems or government portals. With the Digital Personal Data Protection (DPDP) Act now a reality in India, security is a fundamental engineering requirement. Whether you are building a SaaS product for a global market or a local fintech solution, the cost of a breach—both in legal penalties and reputational damage—far outweighs the time spent on secure coding practices.

At DPJ Hub, we approach security as a continuous integration process rather than an afterthought. This article provides a technical checklist that your engineering team can implement this week to harden your web applications against common vulnerabilities.

Input Validation and Data Sanitisation

Most attacks, including SQL injection and Cross-Site Scripting (XSS), stem from trusting user input. You must assume that every string, file, and header sent from the client-side is malicious.

Instead of trying to blacklist 'bad' characters, adopt a whitelist approach. If a field expects a PIN code, only allow numeric digits of a specific length. For web forms, use established libraries like Zod or Joi to enforce schema validation at the API entry point. This prevents malformed data from ever reaching your database layer.

Furthermore, ensure that data is escaped before it is rendered in the browser. Modern frameworks like React and Angular do some of this automatically, but 'dangerouslySetInnerHTML' or direct DOM manipulations remain significant risks. Always use template engines that provide automatic contextual escaping.

Authentication and Session Management

Weak authentication is the quickest way for a malicious actor to gain administrative access. Moving beyond simple username-password combinations is essential.

• Enforce Multi-Factor Authentication (MFA): Use TOTP-based apps or hardware keys. While SMS-based OTP is common in India, it is vulnerable to SIM swapping; encourage app-based authentication where possible.
• Secure Cookie Attributes: Always set HttpOnly, Secure, and SameSite=Strict (or Lax) flags on session cookies. This prevents JavaScript from accessing the cookie and ensures it is only sent over encrypted connections.
• JWT Best Practices: If using JSON Web Tokens, never store sensitive data in the payload. Use a strong signing secret and rotate it regularly. Always implement a short expiration time and a secure refresh token mechanism.

Infrastructure and Environment Hardening

Security does not stop at the code level; it extends to how your application is deployed. We often see developers leave default configurations active in production environments, which provides a roadmap for attackers.

1. Disable Directory Listing: Ensure your web server (Nginx, Apache) is configured to not list files if an index file is missing.
2. Remove Header Fingerprints: Strip headers like X-Powered-By or Server that reveal your tech stack and version numbers. This makes targeted exploits harder to execute.
3. Implement Content Security Policy (CSP): Use CSP headers to tell the browser which scripts, styles, and images are permitted to load. A strict CSP can virtually eliminate the risk of XSS.
4. Use Environment Variables: Never hardcode API keys, database credentials, or secrets in your source code. Use tools like HashiCorp Vault or AWS Secrets Manager, and ensure .env files are included in your .gitignore.

API Security and Rate Limiting

In the era of microservices, your APIs are the primary target. Automated bots can attempt to brute-force login endpoints or scrape proprietary data if you do not have throttling in place.

Implement rate limiting based on IP addresses or user IDs. For example, allow only 5 failed login attempts per 15 minutes before temporary lockout. Additionally, ensure that your REST or GraphQL endpoints perform object-level authorisation. Just because a user is authenticated doesn't mean they should be able to access GET /api/orders/99 if that order belongs to someone else. Every request must verify the ownership of the resource being accessed.

Handling Data under the DPDP Act

For companies operating in India, data residency and privacy are now legal mandates. You must be specific about what data you collect and how it is stored.

Encryption at rest is non-negotiable. Use AES-256 encryption for sensitive personal identifiers in your database. Furthermore, maintain clear logs of who accessed what data and when. However, ensure that these logs do not contain sensitive information like passwords or full credit card numbers—this is a common mistake that leads to 'log leakage'.

Regular Audits and Dependency Management

Your application is only as secure as its weakest third-party library. The modern Node.js or Python ecosystem relies on thousands of external packages.

• Automate Dependency Scanning: Integrate tools like Snyk or GitHub Enterprise Security to scan your package.json or requirements.txt for known vulnerabilities during every build.
• Conduct Periodic Penetration Testing: Automated tools are great, but they miss logical flaws. Engage a team to perform manual 'pentesting' to find flaws in your business logic.
• Update Strategy: Don't wait for a breach to update your framework. Dedicate a small portion of every sprint to technical debt and security patches.

A Practical Checklist for This Week

If you are looking to improve your security posture immediately, follow these five steps:

1. Audit your Headers: Check your site on SecurityHeaders.com and aim for an 'A' grade by adding CSP, HSTS, and X-Content-Type-Options.
2. Review Permissions: Ensure your database user has 'least privilege' access—it should not be a superuser.
3. Rotate Secrets: Change your production API keys and database passwords if they haven't been rotated in the last six months.
4. Sanitise Logs: Search your logging platform for keywords like 'password', 'token', or 'cvv' to ensure no sensitive data is being leaked into your monitoring tools.
5. Enable MFA: Force multi-factor authentication for all internal administrative accounts and cloud console access.

Security is a journey, not a destination. By embedding these practices into your development lifecycle, you create a resilient product that protects your users and your business interests.

Working with DPJ Hub

DPJ Hub provides comprehensive software engineering and product design services that prioritise security from the initial wireframe to the final deployment. Our engineering teams are well-versed in building robust, compliant systems for the Indian and global markets, ensuring your technology stack is both scalable and secure.

Contact us today to discuss how we can audit your current infrastructure and build your next secure web application.