Tutorials

Security Guidelines

Building a secure application is crucial for protecting your users’ data and maintaining their trust. This guide provides a set of basic security principles and best practices that every developer should follow.

Authentication vs. Authorization

Before diving into implementation details, it’s important to understand the difference between authentication and authorization:

  • Authentication is the process of verifying a user’s identity. It answers the question: “Who are you?”. This is typically done by checking credentials like a username and password, or through a third-party provider.

  • Authorization is the process of granting or denying a user access to specific resources or actions. It answers the question: “What are you allowed to do?”. This happens after a user has been successfully authenticated.

For example, when you log into an application, you are authenticating. When you try to access an admin-only page, the application checks if you are authorized to do so.

Implementing Authentication

We strongly recommend using a dedicated third-party service to handle authentication. These services are built by security experts and are kept up-to-date with the latest security patches and best practices.

Recommended services:

If you prefer to manage authentication within your own infrastructure, you can use open-source packages like:

Secure Your Endpoints

Every endpoint in your application should be secured. You should never assume that an endpoint will only be accessed by your frontend application.

For every request, you should:

  1. Authenticate: Check if the request comes from a valid, authenticated user.
  2. Authorize: Check if the authenticated user has the necessary permissions to perform the requested action or access the requested resource.

By default, deny all requests and only grant access to authenticated and authorized users.

Vulnerability Scanning

Regularly scanning your application for vulnerabilities is a critical part of maintaining a secure application. These services automatically scan your application and alert you to potential security issues.

Recommended services:

Secure Hosting and HTTPS

Using a managed hosting solution can help you with many aspects of security, including SSL/TLS termination, DDoS protection, and secure infrastructure.

Recommended hosting providers:

Always use HTTPS for your application. HTTPS encrypts the communication between your users and your server, preventing attackers from intercepting and reading sensitive data. All the recommended hosting providers make it easy to set up HTTPS.

Other Security Best Practices

Here are some other basic security measures you should consider:

  • Input Validation and Sanitization: Never trust user input. Always validate and sanitize any data received from users to prevent common vulnerabilities like Cross-Site Scripting (XSS) and SQL Injection.

  • Keep Dependencies Up-to-Date: Use a tool like GitHub’s Dependabot or Snyk to automatically scan your dependencies for known vulnerabilities and create pull requests to update them.

  • Principle of Least Privilege: Grant users and services the minimum level of access they need to perform their functions.

  • Secure Error Handling: Avoid leaking sensitive information in error messages. Generic error messages should be shown to the user, while detailed errors should be logged for developers to review.

  • Use Security Headers: Implement security headers like Content Security Policy (CSP), Strict-Transport-Security (HSTS), and X-Frame-Options to protect your application from various attacks.