secure-coding-patterns

Secure Coding Patterns & DevSecOps

1. Authentication & Authorization

• MFA / 2FA: Always support multi-factor authentication.
• Tokens: Use short-lived JWTs and secure HttpOnly, SameSite cookies for session management.
• RBAC / ABAC: Implement Role-Based or Attribute-Based Access Control enforcing the Principle of Least Privilege.

2. Input Validation & Sanitization

• Trust No Input: Validate all input on the server-side against a strict schema (e.g., Zod, Joi).
• Sanitization: Encode output to prevent XSS (Cross-Site Scripting).
• SQL Injection Prevention: Always use parameterized queries or ORMs. Never concatenate strings to build SQL queries.

3. Data Protection

• Encryption at Rest: Encrypt sensitive data in the database (e.g., AES-256).
• Encryption in Transit: Enforce TLS 1.2+ for all communications.
• Hashing: Use strong, salted hashing algorithms (Argon2, bcrypt) for passwords.

4. Secret Management

• Never hardcode secrets in source code.
• Use environment variables or dedicated secret vaults (HashiCorp Vault, AWS Secrets Manager).
• Scan repositories for leaked secrets (e.g., GitGuardian, detect-secrets).

5. DevSecOps & CI/CD Integration

• SAST (Static Application Security Testing): Analyze source code for vulnerabilities during the build.
• DAST (Dynamic Application Security Testing): Test the running application for vulnerabilities.
• SCA (Software Composition Analysis): Scan open-source dependencies for known CVEs.

6. Threat Modeling

• Use frameworks like STRIDE (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege) during the design phase.