Web Security Best Practices

Common Threats

• XSS: Injecting malicious scripts into web pages
• CSRF: Forging requests using user credentials
• SQL Injection: Manipulating database queries

XSS Prevention

// Escape user input
function escapeHtml(str) {
  const div = document.createElement('div')
  div.textContent = str
  return div.innerHTML
}

// Use Content Security Policy
res.setHeader('Content-Security-Policy', "default-src 'self'")

CSRF Prevention

// Use CSRF tokens
const csrfToken = crypto.randomBytes(32).toString('hex')

// Use SameSite cookies
Set-Cookie: session=abc123; SameSite=Strict

Other Measures

• Use HTTPS everywhere
• Set security headers with Helmet.js
• Implement rate limiting
• Keep dependencies updated