The Ultimate App Security Cheatsheet: Best Practices for Secure Development

Introduction

Application security encompasses the measures, practices, and tools implemented to protect software applications from threats throughout their lifecycle. As cyber threats continue to evolve in sophistication, securing applications has become a critical priority for organizations. This cheatsheet provides a comprehensive guide to app security best practices for developers, security teams, and organizations to build and maintain secure applications in today’s threat landscape.

Core Security Principles

Defense in Depth

Implement multiple layers of security controls throughout your application:

• Input validation at client side
• Server-side validation
• API gateways
• Web Application Firewalls (WAF)
• Runtime Application Self-Protection (RASP)
• Database security controls

Principle of Least Privilege

Secure by Default

• Start with restrictive configurations
• Require explicit opt-in for risky features
• Disable unnecessary services and components
• Use secure defaults for all configurable security parameters
• Make secure choices the path of least resistance

Trust Nothing (Zero Trust)

• Verify every request regardless of source
• Authenticate and authorize all users and services
• Validate all data inputs
• Apply least privilege consistently
• Enforce access controls at each layer

Secure Coding Practices

Input Validation

Output Encoding

Common Vulnerabilities Prevention

SQL Injection Prevention

✅ Do:

• Use parameterized queries or prepared statements

  // Node.js with MySQLconnection.query('SELECT * FROM users WHERE id = ?', [userId]);// Java with JDBCPreparedStatement stmt = connection.prepareStatement("SELECT * FROM users WHERE id = ?");stmt.setInt(1, userId);ResultSet rs = stmt.executeQuery();
  

• Use ORMs with security features

  // Sequelize (Node.js)User.findByPk(userId);
  

❌ Don’t:

• Concatenate strings to build SQL queries

  // VULNERABLE - DON'T DO THISconst query = "SELECT * FROM users WHERE id = '" + userId + "'";
  

Cross-Site Scripting (XSS) Prevention

✅ Do:

• Encode HTML output based on context
• Implement Content Security Policy (CSP)

  <meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self'">
  

• Use modern frameworks with automatic escaping

  // React automatically escapes valuesreturn <div>{userProvidedText}</div>;
  

❌ Don’t:

• Insert raw user input into HTML

  // VULNERABLE - DON'T DO THISelement.innerHTML = userInput;
  

• Use dangerous JavaScript functions with user input

  // VULNERABLE - DON'T DO THISeval(userInput);document.write(userInput);
  

CSRF (Cross-Site Request Forgery) Prevention

✅ Do:

• Use anti-CSRF tokens

  <form action="/transfer" method="post">  <input type="hidden" name="_csrf" value="random-token-here">  <!-- other form fields --></form>
  

• Validate Origin/Referer headers
• Implement SameSite cookie attribute

  Set-Cookie: sessionid=abc123; SameSite=Strict; Secure; HttpOnly
  

❌ Don’t:

• Rely solely on cookies for authentication
• Allow state-changing operations via GET requests

Server-Side Request Forgery (SSRF) Prevention

✅ Do:

• Validate and sanitize URLs
• Use allow lists for domains/IP ranges
• Implement network-level blocks

❌ Don’t:

• Allow requests to internal resources
• Blindly follow redirects

Authentication & Authorization

Authentication Best Practices

Secure Password Hashing Examples

// Node.js with bcrypt
const bcrypt = require('bcrypt');
const saltRounds = 12;

// Hashing
const hashedPassword = await bcrypt.hash(password, saltRounds);

// Verification
const isMatch = await bcrypt.compare(password, hashedPassword);

# Python with Argon2
from argon2 import PasswordHasher

ph = PasswordHasher()

# Hashing
hash = ph.hash(password)

# Verification
try:
    ph.verify(hash, password)
    # Password is correct
except:
    # Password is incorrect

Authorization Best Practices

Role-Based Access Control (RBAC)

// Define roles and permissions
const roles = {
  admin: ['read', 'write', 'delete', 'manage_users'],
  editor: ['read', 'write'],
  viewer: ['read']
};

// Check permission
function hasPermission(user, permission) {
  const userRole = user.role;
  return roles[userRole] && roles[userRole].includes(permission);
}

// Use in routes/controllers
function deleteResource(user, resourceId) {
  if (!hasPermission(user, 'delete')) {
    throw new Error('Unauthorized');
  }
  // Proceed with deletion
}

Attribute-Based Access Control (ABAC)

// More complex policy check
function canAccessResource(user, resource, action) {
  // Resource ownership check
  if (resource.ownerId === user.id) {
    return true;
  }
  
  // Department-based check
  if (user.department === resource.department && hasPermission(user, action)) {
    return true;
  }
  
  // Time-based restriction
  const currentHour = new Date().getHours();
  if (currentHour < 9 || currentHour > 17) {
    return false;
  }
  
  return false;
}

OAuth 2.0 & OpenID Connect

Secure Data Handling

Data Classification

Encryption Best Practices

Encryption Code Examples

// Node.js symmetric encryption with AES
const crypto = require('crypto');

function encrypt(text, key) {
  const iv = crypto.randomBytes(16);
  const cipher = crypto.createCipheriv('aes-256-gcm', key, iv);
  
  let encrypted = cipher.update(text, 'utf8', 'hex');
  encrypted += cipher.final('hex');
  
  const authTag = cipher.getAuthTag().toString('hex');
  
  // Return IV + Auth Tag + Encrypted Data
  return iv.toString('hex') + authTag + encrypted;
}

function decrypt(encryptedData, key) {
  const iv = Buffer.from(encryptedData.substring(0, 32), 'hex');
  const authTag = Buffer.from(encryptedData.substring(32, 64), 'hex');
  const encryptedText = encryptedData.substring(64);
  
  const decipher = crypto.createDecipheriv('aes-256-gcm', key, iv);
  decipher.setAuthTag(authTag);
  
  let decrypted = decipher.update(encryptedText, 'hex', 'utf8');
  decrypted += decipher.final('utf8');
  
  return decrypted;
}

Secure Key Management

• Use key management services (KMS) provided by cloud providers
• Implement key rotation policies
• Separate storage for keys and encrypted data
• Use hardware security modules for critical keys
• Follow the principle of least privilege for key access

API Security

API Security Checklist

REST API Security Headers

GraphQL Security

• Implement depth limiting to prevent nested query attacks
• Use query cost analysis for complexity-based throttling
• Leverage persisted queries for production environments
• Apply field-level authorization
• Avoid exposing error details that reveal schema information

// Apollo Server with depth limiting
const server = new ApolloServer({
  typeDefs,
  resolvers,
  validationRules: [
    depthLimit(5), // Limit query depth
    costAnalysis({
      maximumCost: 1000,
      variables: {},
      defaultCost: 1,
    }),
  ],
});

Mobile App Security

Android Security Best Practices

Android Certificate Pinning Example

// OkHttp Certificate Pinning
val client = OkHttpClient.Builder()
    .certificatePinner(
        CertificatePinner.Builder()
            .add("api.example.com", "sha256/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=")
            .add("api.example.com", "sha256/BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB=")
            .build()
    )
    .build()

iOS Security Best Practices

iOS Keychain Usage Example

// Save to Keychain
func saveToKeychain(key: String, data: Data) -> Bool {
    let query: [String: Any] = [
        kSecClass as String: kSecClassGenericPassword,
        kSecAttrAccount as String: key,
        kSecValueData as String: data,
        kSecAttrAccessible as String: kSecAttrAccessibleWhenUnlockedThisDeviceOnly
    ]
    
    SecItemDelete(query as CFDictionary)
    let status = SecItemAdd(query as CFDictionary, nil)
    return status == errSecSuccess
}

// Retrieve from Keychain
func loadFromKeychain(key: String) -> Data? {
    let query: [String: Any] = [
        kSecClass as String: kSecClassGenericPassword,
        kSecAttrAccount as String: key,
        kSecReturnData as String: true,
        kSecMatchLimit as String: kSecMatchLimitOne
    ]
    
    var dataTypeRef: AnyObject?
    let status = SecItemCopyMatching(query as CFDictionary, &dataTypeRef)
    
    if status == errSecSuccess {
        return dataTypeRef as? Data
    } else {
        return nil
    }
}

Cloud & Infrastructure Security

Container Security

Docker Security Example

# Multi-stage build for minimal attack surface
FROM node:18-alpine AS build
WORKDIR /app
COPY package*.json ./
RUN npm ci
COPY . .
RUN npm run build

# Production image with minimal footprint
FROM node:18-alpine
RUN apk --no-cache add dumb-init
ENV NODE_ENV production
WORKDIR /app
COPY --from=build /app/dist /app/dist
COPY --from=build /app/node_modules /app/node_modules

# Create non-root user
RUN addgroup -g 1001 nodejs && adduser -u 1001 -G nodejs -s /bin/sh -D nodejs
USER nodejs

# Use dumb-init as entrypoint for proper signal handling
ENTRYPOINT ["dumb-init", "--"]
CMD ["node", "dist/server.js"]

# Apply security labels
LABEL org.opencontainers.image.vendor="Company Name"
LABEL org.opencontainers.image.source="https://github.com/company/repo"
LABEL org.opencontainers.image.revision="commit-sha"

Serverless Security

Cloud Security Controls

Security Testing

Testing Types and Tools

Security Testing in CI/CD

# GitHub Actions security workflow
name: Security Scan

on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]

jobs:
  security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      
      - name: Install dependencies
        run: npm ci
      
      - name: Run SAST scan
        uses: github/codeql-action/analyze@v2
        with:
          languages: javascript
      
      - name: Run dependency scan
        uses: snyk/actions/node@master
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
      
      - name: Run container scan
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: 'my-app:latest'
          format: 'sarif'
          output: 'trivy-results.sarif'
      
      - name: Run OWASP ZAP scan
        uses: zaproxy/action-full-scan@v0.4.0
        with:
          target: 'https://staging-app.example.com'

Security Monitoring & Incident Response

Security Monitoring Components

Security Logging Best Practices

Incident Response Plan

1. Preparation

   • Document systems and assets
   • Establish IR team and roles
   • Create communication templates
   • Develop playbooks for common incidents

2. Detection & Analysis

   • Monitor security alerts
   • Perform initial triage
   • Determine scope and impact
   • Classify incident severity

3. Containment

   • Isolate affected systems
   • Block attack vectors
   • Preserve evidence
   • Implement temporary workarounds

4. Eradication

   • Remove malicious components
   • Patch vulnerabilities
   • Reset compromised credentials
   • Validate system integrity

5. Recovery

   • Restore from clean backups
   • Verify system functionality
   • Monitor for recurring issues
   • Phase in normal operations

6. Post-Incident

   • Conduct root cause analysis
   • Document lessons learned
   • Update security controls
   • Enhance detection capabilities

Compliance & Regulatory Considerations

Common Regulations by Region

Key Compliance Controls for Applications

Resources for Further Learning

Organizations & Standards

• OWASP (Open Web Application Security Project)

  • OWASP Top 10
  • OWASP Application Security Verification Standard (ASVS)
  • OWASP Software Component Verification Standard

• NIST (National Institute of Standards and Technology)

  • NIST Cybersecurity Framework
  • NIST SP 800-53 Security Controls

• CIS (Center for Internet Security)

  • CIS Controls
  • CIS Benchmarks

Books & Publications

• “The Web Application Hacker’s Handbook” by Dafydd Stuttard and Marcus Pinto
• “Agile Application Security” by Laura Bell, Jim Bird, and Michael Brunton-Spall
• “Threat Modeling: Designing for Security” by Adam Shostack
• “Cloud Security: A Comprehensive Guide to Secure Cloud Computing” by Ronald L. Krutz and Russell Dean Vines

Online Resources

• PortSwigger Web Security Academy – Free interactive web security training
• Troy Hunt’s Blog – Web security insights and analysis
• Google’s Web Security Guide
• AWS Security Best Practices
• Mozilla Web Security Guidelines