Web Security Fundamentals: A Developer's Guide to Data Protection and Privacy

2. Cross-Site Scripting (XSS) Prevention

XSS attacks inject malicious scripts into trusted websites. There are three main types: Stored XSS (persistent), Reflected XSS (non-persistent), and DOM-based XSS.

Input Validation and Output Encoding

The golden rule: Never trust user input. All data from users must be validated on input and encoded on output.

// VULNERABLE CODE - Never do this
echo "
Hello " . $_POST['username'] . "
";

// SECURE CODE - Always escape output
echo "
Hello " . htmlspecialchars($_POST['username'], ENT_QUOTES, 'UTF-8') . "
";

// JavaScript context requires different encoding
echo '';

Content Security Policy (CSP)

CSP provides an additional layer of protection by controlling which resources the browser is allowed to load:

// Basic CSP header
Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'

// Strict CSP (recommended)
Content-Security-Policy: default-src 'none'; script-src 'self'; style-src 'self'; img-src 'self' data:; font-src 'self'

3. Authentication and Session Management

Secure authentication goes far beyond checking usernames and passwords. It encompasses the entire user session lifecycle.

Password Security Best Practices

• Use strong hashing algorithms: bcrypt, scrypt, or Argon2 (never MD5 or SHA1)
• Implement proper salt:Unique salt per password to prevent rainbow table attacks
• Set minimum complexity requirements:Length matters more than character diversity
• Rate limiting:Prevent brute force attacks with exponential backoff

// PHP: Secure password hashing
$password = $_POST['password'];
$hash = password_hash($password, PASSWORD_ARGON2ID, ['cost' => 12]);

// Verification
if (password_verify($password, $hash)) {
    // Password is correct
}

// Node.js: Using bcrypt
const bcrypt = require('bcrypt');
const saltRounds = 12;
const hash = await bcrypt.hash(password, saltRounds);

Session Security

Secure session management prevents session hijacking and fixation attacks:

• Use HTTPS only:Set secure flag on cookies
• HttpOnly cookies:Prevent JavaScript access to session cookies
• SameSite attribute:Protect against CSRF attacks
• Session regeneration:Change session ID after login
• Proper expiration:Implement both absolute and idle timeouts

4. Data Encryption and Protection

Encryption at Rest and in Transit

Data encryption should be implemented at multiple layers:

• HTTPS everywhere:TLS 1.3 minimum, HTTP/2 for performance
• Database encryption:Encrypt sensitive fields at the application layer
• File system encryption:Full disk encryption for servers
• Backup encryption:Encrypt all data backups with separate keys

Key Management

Poor key management is often the weakest link in encryption:

5. Privacy by Design and GDPR Compliance

Privacy isn't just about compliance'it's about building trust with your users and designing systems that respect their rights.

Data Minimization Principles

• Collect only necessary data:Question every field in your forms
• Purpose limitation:Use data only for stated purposes
• Storage limitation:Implement automatic data deletion policies
• Data anonymization:Remove or encrypt personally identifiable information

User Rights Implementation

GDPR grants users specific rights that must be technically implemented:

6. Security Tools and Monitoring

Essential Security Tools

Integrate security into your development workflow with these essential tools:

• Static Application Security Testing (SAST):SonarQube, CodeQL, Semgrep
• Dynamic Application Security Testing (DAST):OWASP ZAP, Burp Suite
• Dependency Scanning:Snyk, npm audit, OWASP Dependency-Check
• Secret Scanning:GitLeaks, TruffleHog, GitHub Secret Scanning

Security Monitoring and Incident Response

Implement comprehensive logging and monitoring to detect and respond to security incidents:

1. Log authentication events:Successful and failed login attempts
2. Monitor privileged operations:Admin actions, data exports, configuration changes
3. Track data access patterns:Unusual data access or bulk operations
4. Set up alerting:Real-time notifications for suspicious activities
5. Implement SIEM:Security Information and Event Management systems