Framework-level protections.
WHAT FRAMEWORKS PROVIDE BY DEFAULT
Escaping in templates Cross-site request protection on forms Parameterised queries through the data layer Password hashing designed for passwords
WHAT TO CHECK
Where any of those has been disabled, and why.
WHAT TO NEVER DO
Disable request protection to make something work Output unescaped content from user input Build queries by joining strings
WHAT TO RESTRICT
Mass assignment, so a request cannot set unintended fields.
WHAT TO CONFIGURE
Debug disabled in production Errors logged rather than displayed Secure session cookie settings
WHY DEBUG MATTERS SO MUCH
It exposes paths, versions, configuration and sometimes credentials.
WHAT TO PLACE OUTSIDE THE SERVED DIRECTORY
Everything except the entry point and public assets.
WHY
Otherwise configuration containing credentials can be requested directly.
WHAT TO VERIFY
Try requesting the configuration file in a browser. It must not be served.
WHAT TO CHECK ON EVERY PROTECTED ACTION
That the user owns the specific record, not merely that they are signed in.
WHAT TO KEEP UPDATED
The framework, its dependencies, and the language version.
