Real-world breaches rarely involve exotic zero-days. They involve a forgotten admin endpoint, a dependency nobody updated, an ID in a URL that nobody checked ownership on. Security for most web applications is not wizardry; it is a short list of fundamentals applied without exception.
Authentication: do not hand-roll it
Use your framework's or a reputable provider's auth rather than inventing your own. Hash passwords with bcrypt or argon2, never anything homemade or fast. Rate limit login and reset endpoints, and return identical messages for wrong-email and wrong-password, because attackers enumerate accounts through the difference. Offer multi-factor authentication, and require it for anything administrative.
Authorization: check ownership everywhere
The most common critical bug in production apps is insecure direct object reference: /orders/1234 happily serving order 1234 to whoever asks. Every request must verify not just that a user is logged in but that this user may touch this resource. Enforce it in one shared layer, not in each handler's good intentions, and write tests that try to cross tenant boundaries.
The input rules that never expire
- Parameterized queries always; string-built SQL is how injection still happens in new code.
- Escape output by default and let your template engine do it; XSS arrives wherever someone bypassed the escaping.
- Validate uploads by content, store them outside the web root, and serve them from a separate domain.
- Set the security headers, CSP, HSTS, frame-ancestors, and secure, httpOnly cookies.
Dependencies and secrets
Your app includes thousands of packages other people wrote; automated vulnerability scanning and a monthly update habit are the entire defense. Keep secrets in environment configuration or a secrets manager, never in the repository, and rotate anything that ever leaked. None of this is glamorous, which is exactly why the teams that do it consistently are rare, and rarely breached.